helopal.club Open in urlscan Pro
2606:4700:3035::6815:5c4b Public Scan

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://helopal.club
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 169ms
129ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=20988&site_id=513654&zone_id=3082760&size_id=2&alt_size_ids=39%2C55&gdpr=0&rp_schain=1.0,1!optad360.com,8436870,1,,,&eid_pubcid.org=e4dc7d70-9b3d-4ec3-8f8a-54a1ab6f6ca8%5E1&rf=https%3A%2F%2Fhelopal.club%2F&kw=Smart%2Cfriendship%2Cchallenge%2CMake%2Cquiz%2CFriendshipDare%2CDare2022%2CLoveDare2022&tg_i.page=https%3A%2F%2Fhelopal.club%2F&tg_i.domain=helopal.club&tk_flint=pbjs_lite_v7.36.0&x_source.tid=a93c7968-21e6-4c3d-b098-9f2813972c10&l_pb_bid_id=4861d505f25b51&p_screen_res=1600x1200&rp_secure=1&rp_hard_floor=0.0125&rp_maxbids=1&slots=1&rand=0.003770446855285714
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 6c765580728797a4c4a1f6e3009a4543d25a8e7e2964337403ac224ec1f706f2

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
content-encoding: gzip
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 143ms
103ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=477094&zone_id=2872706&size_id=2&alt_size_ids=39%2C55&gdpr=0&rp_schain=1.0,1!optad360.com,8436870,1,,,&eid_pubcid.org=e4dc7d70-9b3d-4ec3-8f8a-54a1ab6f6ca8%5E1&rf=https%3A%2F%2Fhelopal.club%2F&kw=Smart%2Cfriendship%2Cchallenge%2CMake%2Cquiz%2CFriendshipDare%2CDare2022%2CLoveDare2022&tg_i.page=https%3A%2F%2Fhelopal.club%2F&tg_i.domain=helopal.club&tk_flint=pbjs_lite_v7.36.0&x_source.tid=a93c7968-21e6-4c3d-b098-9f2813972c10&l_pb_bid_id=54f4af03e46eea&p_screen_res=1600x1200&rp_secure=1&rp_hard_floor=0.0125&rp_maxbids=1&slots=1&rand=0.289008239556257
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 8b7ec456a0cf37c3d45f4764713d118a215b11c09296ca0bf9d7a2289a75895b

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:36 GMT
content-encoding: gzip
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 96ms
52ms XHR
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 9f7bda6b0c8c48293f46860952db4d54390f81de655355dc7bad2e0fd419f6e4

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 Dec 2023 15:00:36 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://helopal.club
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1983
Expires: 0

POST
H2 204 / Show response
ssp.wp.pl/bidder/ 0
172 B 138ms
36ms XHR
text/plain 212.77.99.29
WIRTUALNAPOLSKA G...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/?bdver=5.7&pbver=7.36.0&inver=0
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 , Poland, ASN12827 (WIRTUALNAPOLSKA GDANSK, Poland, PL),
Reverse DNS: ssp.wp.pl
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:36 GMT
access-control-allow-credentials: true
accept-ch: device-memory, dpr, width, viewport-width, rtt, downlink, ect
server: nginx
vary: Origin
accept-ch-lifetime: 604800

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
351 B 47ms
16ms XHR
text/plain 145.40.97.67
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.97.67 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:36 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
server: envoy
vary: origin, Accept-Encoding

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
174 B 68ms
18ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:36 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H2 200 openrtb Show response
adx.adform.net/adx/ 2 KB
2 KB 135ms
53ms XHR
application/json 37.157.6.233
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

a64f924f7eecd0ef8d6b8fd672ceff3d645afeebc65cda4838ac089892fa1cd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Dec 2023 15:00:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
pragma: no-cache
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
access-control-allow-methods: POST,OPTIONS
content-type: application/json
access-control-allow-origin: https://helopal.club
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
175 B 65ms
18ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:36 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 96ms
59ms XHR
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 37ea8070090eb5470f64d57ca76dce72bb83db50a72f943643b6ab85ac49d094

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 Dec 2023 15:00:36 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://helopal.club
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1982
Expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
408 B 23ms
8ms XHR
application/json 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://helopal.club
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 319 B
658 B 139ms
107ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=20988&site_id=513654&zone_id=3082760&size_id=43&alt_size_ids=117&gdpr=0&rp_schain=1.0,1!optad360.com,8436870,1,,,&eid_pubcid.org=e4dc7d70-9b3d-4ec3-8f8a-54a1ab6f6ca8%5E1&rf=https%3A%2F%2Fhelopal.club%2F&kw=Smart%2Cfriendship%2Cchallenge%2CMake%2Cquiz%2CFriendshipDare%2CDare2022%2CLoveDare2022&tg_i.page=https%3A%2F%2Fhelopal.club%2F&tg_i.domain=helopal.club&tk_flint=pbjs_lite_v7.36.0&x_source.tid=1fcb4b3a-574e-46e9-8850-6d4eeef7f124&l_pb_bid_id=233d479fd50206c&p_screen_res=1600x1200&rp_secure=1&rp_hard_floor=0.0125&rp_maxbids=1&slots=1&rand=0.2734713469381609
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 4baba6636758b3880eadfeb99f51dff0038eb7fc5df1a0cbfd9eb4b9847080a9

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:36 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 319
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 319 B
657 B 136ms
105ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=477094&zone_id=2872706&size_id=43&alt_size_ids=117&gdpr=0&rp_schain=1.0,1!optad360.com,8436870,1,,,&eid_pubcid.org=e4dc7d70-9b3d-4ec3-8f8a-54a1ab6f6ca8%5E1&rf=https%3A%2F%2Fhelopal.club%2F&kw=Smart%2Cfriendship%2Cchallenge%2CMake%2Cquiz%2CFriendshipDare%2CDare2022%2CLoveDare2022&tg_i.page=https%3A%2F%2Fhelopal.club%2F&tg_i.domain=helopal.club&tk_flint=pbjs_lite_v7.36.0&x_source.tid=1fcb4b3a-574e-46e9-8850-6d4eeef7f124&l_pb_bid_id=244ab056c3a2eb6&p_screen_res=1600x1200&rp_secure=1&rp_hard_floor=0.0125&rp_maxbids=1&slots=1&rand=0.648181023030769
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 1d175839d8ff797dc46ee269c6876c21895dd6df126f4602ff8d46ee9e0416f9

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:36 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 319
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 / Show response
ssp.wp.pl/bidder/ 0
17 B 131ms
36ms XHR
text/plain 212.77.99.29
WIRTUALNAPOLSKA G...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/?bdver=5.7&pbver=7.36.0&inver=0
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 , Poland, ASN12827 (WIRTUALNAPOLSKA GDANSK, Poland, PL),
Reverse DNS: ssp.wp.pl
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:36 GMT
access-control-allow-credentials: true
accept-ch: device-memory, dpr, width, viewport-width, rtt, downlink, ect
server: nginx
vary: Origin
accept-ch-lifetime: 604800

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
530 B 98ms
21ms XHR
text/plain 37.157.6.233
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
210 B 43ms
20ms XHR
text/plain 145.40.97.67
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.97.67 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:36 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5
server: envoy
vary: origin, Accept-Encoding

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 230F 10 KB
1 KB 167ms
166ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1696164081359292&output=html&adk=1812271804&adf=3025194257&lmt=1702047636&plat=4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x1080_l&format=0x0&url=https%3A%2F%2Fhelopal.club%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702047636613&bpp=3&bdt=335&idt=273&shv=r20231206&mjsv=m202312040101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2867536099469&frm=20&pv=2&ga_vid=865504423.1702047637&ga_sid=1702047637&ga_hid=1441285274&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079865%2C31079921%2C42531705%2C44809005%2C95320229&oid=2&pvsid=2398167256370812&tmod=1911696006&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=284

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312040101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1696164081359292&plah=helopal.club

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fb7828000d896527d60d4866afd681d3766d4a367c3db1439c6d9b3a48900cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 1023
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:37 GMT
expires: Fri, 08 Dec 2023 15:00:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9589 163 KB
47 KB 745ms
744ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1696164081359292&output=html&h=280&slotname=3067619107&adk=2984494112&adf=54630664&pi=t.ma~as.3067619107&w=1200&fwrn=4&fwrnh=100&lmt=1702047636&rafmt=1&format=1200x280&url=https%3A%2F%2Fhelopal.club%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702047636616&bpp=2&bdt=338&idt=292&shv=r20231206&mjsv=m202312040101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2867536099469&frm=20&pv=1&ga_vid=865504423.1702047637&ga_sid=1702047637&ga_hid=1441285274&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=4386&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079865%2C31079921%2C42531705%2C44809005%2C95320229&oid=2&pvsid=2398167256370812&tmod=1911696006&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=295

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7aada0fa68f0a9dda2dff3d7832949c556844d593033eacbbd578ddd1096c934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 47906
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:37 GMT
expires: Fri, 08 Dec 2023 15:00:37 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 244 KB
84 KB 67ms
66ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VWZGSQLZ5T&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-176069477-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5346e5b0651c045c8381191ebf1d760cb7f39e108a9d6a50de49df5f00445472

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 86182
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 08 Dec 2023 15:00:36 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 161ms
53ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-176069477-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 08 Dec 2023 13:41:48 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 4729
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 08 Dec 2023 15:41:48 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 224 KB
79 KB 74ms
74ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-WEZNDFHJK0&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-136873609-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

54ba65f2f0af00c5ee413e22e99f5cc42f3eab745ad0ace94d008032714c0e00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 81193
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 08 Dec 2023 15:00:36 GMT

GET
H2 200 webConfig Show response
firebase.googleapis.com/v1alpha/projects/-/apps/1:478958754494:web:7d6b77a9cd316f195b9cef/ 262 B
379 B 70ms
69ms Fetch
application/json 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firebase.googleapis.com/v1alpha/projects/-/apps/1:478958754494:web:7d6b77a9cd316f195b9cef/webConfig

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/firebasejs/9.9.1/firebase-analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6f8bfefec2cd703c79b6f039fa4091160c9ff5a67d9d3b7d159924304517d869

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept: application/json
Referer: https://helopal.club/
x-goog-api-key: AIzaSyDHcMOju22-gYCaa1f3BVFqAFpu8C8D6vY
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://helopal.club
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190
x-xss-protection: 0

OPTIONS
H2 200 webConfig
firebase.googleapis.com/v1alpha/projects/-/apps/1:478958754494:web:7d6b77a9cd316f195b9cef/ Frame 0
0 196ms
67ms Preflight
text/html 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firebase.googleapis.com/v1alpha/projects/-/apps/1:478958754494:web:7d6b77a9cd316f195b9cef/webConfig

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-api-key
Access-Control-Request-Method: GET
Origin: https://helopal.club
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: x-goog-api-key
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://helopal.club
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Fri, 08 Dec 2023 15:00:37 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ 75 KB
24 KB 40ms
24ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26305a08644b4f51b55812cf0ecf879c22da303a365b3d2769baa1b54c028c4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:36 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 719738
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 27 Nov 2023 07:14:07 GMT
Server: cloudflare
ETag: W/"6faf3acfde3bb82adada71be4fc1deb0"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yapImsH7JUhr%2FGm68GsZs0ReO622m3f096tAhvXaO0d8dWeKOw89yBIYpNLQJPyqiQPecaGN13c%2BgvNOgSAmE2zyTbu1nE2SaoKVCJHTxUN39E3xJVg3QM0%2FJ49ive%2FB3aZb8i2HQ%2BnErcsQ"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 8325e102eed818e4-FRA

OPTIONS
H2 200 installations
firebaseinstallations.googleapis.com/v1/projects/helopal-ae713/ Frame 0
0 186ms
72ms Preflight
text/html 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firebaseinstallations.googleapis.com/v1/projects/helopal-ae713/installations

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-firebase-client,x-goog-api-key
Access-Control-Request-Method: POST
Origin: https://helopal.club
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-firebase-client,x-goog-api-key
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://helopal.club
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Fri, 08 Dec 2023 15:00:37 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H2 200 installations Show response
firebaseinstallations.googleapis.com/v1/projects/helopal-ae713/ 625 B
678 B 346ms
346ms Fetch
application/json 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://firebaseinstallations.googleapis.com/v1/projects/helopal-ae713/installations

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/firebasejs/9.9.1/firebase-analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

25cb0c014feabd8c4c0d24c6f0c47e0375ec8bb12248da5bd0100fed5121604f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept: application/json
Referer: https://helopal.club/
x-goog-api-key: AIzaSyDHcMOju22-gYCaa1f3BVFqAFpu8C8D6vY
accept-language: de-DE,de;q=0.9
x-firebase-client: eyJ2ZXJzaW9uIjoyLCJoZWFydGJlYXRzIjpbeyJhZ2VudCI6ImZpcmUtY29yZS8wLjcuMjkgZmlyZS1jb3JlLWVzbTIwMTcvMC43LjI5IGZpcmUtanMvIGZpcmUtanMtYWxsLWNkbi85LjkuMSBmaXJlLWlpZC8wLjUuMTIgZmlyZS1paWQtZXNtMjAxNy8wLjUuMTIgZmlyZS1hbmFseXRpY3MvMC44LjAgZmlyZS1hbmFseXRpY3MtZXNtMjAxNy8wLjguMCBmaXJlLWZjbS8wLjkuMTYgZmlyZS1mY20tZXNtMjAxNy8wLjkuMTYiLCJkYXRlcyI6WyIyMDIzLTEyLTA4Il19XX0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
content-type: application/json

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://helopal.club
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 488
x-xss-protection: 0

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
208 B 18ms
17ms XHR
text/plain 145.40.97.67
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.97.67 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:36 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
server: envoy
vary: origin, Accept-Encoding

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
174 B 18ms
17ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:37 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 322 B
355 B 94ms
94ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=20988&site_id=513654&zone_id=3082760&size_id=9&alt_size_ids=8%2C10%2C14%2C48%2C126&gdpr=0&rp_schain=1.0,1!optad360.com,8436870,1,,,&eid_pubcid.org=e4dc7d70-9b3d-4ec3-8f8a-54a1ab6f6ca8%5E1&rf=https%3A%2F%2Fhelopal.club%2F&kw=Smart%2Cfriendship%2Cchallenge%2CMake%2Cquiz%2CFriendshipDare%2CDare2022%2CLoveDare2022&tg_i.page=https%3A%2F%2Fhelopal.club%2F&tg_i.domain=helopal.club&tk_flint=pbjs_lite_v7.36.0&x_source.tid=4f589009-14c9-4d00-a1f7-a729c19748dd&l_pb_bid_id=36dd72077a3b428&p_screen_res=1600x1200&rp_secure=1&rp_hard_floor=0.0125&rp_maxbids=1&slots=1&rand=0.2919573703228755
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 1edfac5c088ed3e1466c757f9b3305cd19669b405a308d875feab389a01caf7c

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 322
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
5 KB 109ms
109ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=477094&zone_id=2872706&size_id=9&alt_size_ids=8%2C10%2C14%2C48%2C126&gdpr=0&rp_schain=1.0,1!optad360.com,8436870,1,,,&eid_pubcid.org=e4dc7d70-9b3d-4ec3-8f8a-54a1ab6f6ca8%5E1&rf=https%3A%2F%2Fhelopal.club%2F&kw=Smart%2Cfriendship%2Cchallenge%2CMake%2Cquiz%2CFriendshipDare%2CDare2022%2CLoveDare2022&tg_i.page=https%3A%2F%2Fhelopal.club%2F&tg_i.domain=helopal.club&tk_flint=pbjs_lite_v7.36.0&x_source.tid=4f589009-14c9-4d00-a1f7-a729c19748dd&l_pb_bid_id=3790c77bf25fe08&p_screen_res=1600x1200&rp_secure=1&rp_hard_floor=0.0125&rp_maxbids=1&slots=1&rand=0.20125209008313183
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 2001c42b2ce2b362f5fa875d0d45cda31c83709d6592ce20040ad38e9eda556a

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
content-encoding: gzip
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 / Show response
ssp.wp.pl/bidder/ 0
40 B 42ms
42ms XHR
text/plain 212.77.99.29
WIRTUALNAPOLSKA G...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/?bdver=5.7&pbver=7.36.0&inver=0
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 , Poland, ASN12827 (WIRTUALNAPOLSKA GDANSK, Poland, PL),
Reverse DNS: ssp.wp.pl
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:37 GMT
access-control-allow-credentials: true
accept-ch: device-memory, dpr, width, viewport-width, rtt, downlink, ect
server: nginx
vary: Origin
accept-ch-lifetime: 604800

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 14ms
14ms XHR
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: a44cc65f511f52da0151987fc2786a19fb311a97b5c4d7fb44c138fcf39e2067

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 08 Dec 2023 15:00:37 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://helopal.club
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1982
Expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
408 B 9ms
7ms XHR
application/json 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://helopal.club
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
529 B 22ms
21ms XHR
text/plain 37.157.6.233
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 204 collect
region1.google-analytics.com/g/ 0
243 B 100ms
36ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-VWZGSQLZ5T&gtm=45je3bt0v879222134&_p=1702047636536&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=865504423.1702047637&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1702047637&sct=1&seg=0&dl=https%3A%2F%2Fhelopal.club%2F&dt=Play%20Friendship%20Quiz%20-%20Helopal.club&en=page_view&_fv=1&_ss=1&tfd=1190
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VWZGSQLZ5T&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 81ms
37ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-WEZNDFHJK0&gtm=45je3bt0v9132638245&_p=1702047636536&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=865504423.1702047637&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1702047637&sct=1&seg=0&dl=https%3A%2F%2Fhelopal.club%2F&dt=Play%20Friendship%20Quiz%20-%20Helopal.club&en=page_view&_fv=1&_ss=1&tfd=1210
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-WEZNDFHJK0&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 86ms
85ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_auto_rs&sts=pfno&evt=place&vh=1200&eid=44808454&hl=en&pvc=2398167256370812

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
204 B 60ms
60ms XHR
text/plain 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1441285274&t=pageview&_s=1&dl=https%3A%2F%2Fhelopal.club%2F&ul=en-us&de=UTF-8&dt=Play%20Friendship%20Quiz%20-%20Helopal.club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=345977872&gjid=1145619009&cid=865504423.1702047637&tid=UA-176069477-1&_gid=1915370738.1702047637&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=25139529

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
69 B 60ms
60ms XHR
text/plain 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1441285274&t=pageview&_s=1&dl=https%3A%2F%2Fhelopal.club%2F&ul=en-us&de=UTF-8&dt=Play%20Friendship%20Quiz%20-%20Helopal.club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1527108518&gjid=602984699&cid=865504423.1702047637&tid=UA-136873609-1&_gid=1915370738.1702047637&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=867607720

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/ 432 KB
135 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c417bdd5756646f7102a004458c6aa90e7a4c7ff04631494f0a9b8099619343d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 11:58:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10953
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138293
x-xss-protection: 0
server: cafe
etag: 11350998454379829730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 07 Dec 2024 11:58:04 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
344 B 158ms
53ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-136873609-1&cid=865504423.1702047637&jid=1527108518&gjid=602984699&_gid=1915370738.1702047637&_u=YADAAUABAAAAACAAI~&z=475453641

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Fri, 08 Dec 2023 15:00:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 202 KB
74 KB 70ms
69ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Z45V12ZWF9&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-176069477-1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

25b1808c891a37b3001543555622e93ba4b454cdffca4c6abf4ee8fbbe9f2ead

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 75555
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 08 Dec 2023 15:00:37 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 53ms
15ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 12 Nov 2023 06:38:57 GMT
content-encoding: gzip
age: 2276500
x-guploader-uploadid: ABPtcPqNl0_c7mOVHVehFbpvBDCYrlpMq3zlKY0iT8ZNCSTUmKqOFKvvyge5cYXvjpEp3qctN1IhbOKtoVDeGx23F8-Q
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Mon, 11 Nov 2024 06:38:57 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 43 KB
13 KB 60ms
28ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

2f1ad4ec7176f493b16e0d186f222e3484248cbb48f82289c736a0877f2d5894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 05 Dec 2023 05:12:22 GMT
server: nginx
etag: W/"656eb136-aa2f"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 09 Dec 2023 15:00:37 GMT

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 152 KB
34 KB 42ms
22ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65d03eb82a79a732d7c0180593c4f5dc98a8fac5c20c3a5446c4f14bf93d280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Dec 2023 12:57:20 GMT
server: cloudflare
x-amz-request-id: 9XEJCTBGXMH6BWG7
age: 2727
etag: W/"5fcefeebf5ddc7b2ddf2435967e63de9"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8325e10589076915-FRA
x-amz-id-2: 6lDvA/NG13Ah70SYz7rinfNBhtPRqYB8cRNAXOB0HrHMJ4cExka3o6S7+kAh+aqG5/Nc7+/gZfgdF9MgeI4iQg==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 67ms
15ms Script
text/javascript 2600:9000:2447:6400:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2447:6400:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Fri, 08 Dec 2023 09:10:16 GMT
Via: 1.1 1dd177f0f1668dc5abba6f90eb9da04c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS58-P5
Age: 30983
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: CJXDgLUtNu1-89OkLcbp-YU8iFC3rpAJ1y_imF0rEeN7ekZK4KRnew==

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 34ms
22ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 31187
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230100-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BXmP8%2BchUkTGbZ3Zmxr8DkaRYpNez3dQr0psp2QUjxlAytJow9NxDQMtLmxk7oJe3cCJrDZyUcgST3WpU7Y8jih4md1Tjth7A5qOu6wzVk2MR49pL0cZ10whHSEQKa0sR%2FufB09FMrP2xYPgdVs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8325e105780e1c19-FRA

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 35ms
8ms Script
text/javascript 65.9.66.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-104.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 04:16:06 GMT
content-encoding: gzip
via: 1.1 6165dcc1fdf84ac65e8204c05709f1ca.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 38672
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: oq1YHVtADIIlArExdW8Ccz7XvLkfQmsfpsu6-I7Zln7Zlgys4WyILA==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 75ms
38ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 735e4ac3b30cae2b5efc388f31625af3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 110 KB
45 KB 474ms
473ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2398167256370812&correlator=3481018421975161&eid=31079239%2C31078659&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=121764058%3A23001273585%2Chelopal.club%2Chelopal.club_o3b_display_adi_o3b_atf&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x100%7C320x50%7C360x100%7C360x50%7C700x100%7C700x90&ifi=3&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1702047637330&lmt=1702047637&adxs=640&adys=111&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fhelopal.club%2F&vis=1&psz=0x0&msz=320x0&fws=644&ohw=1600&ga_vid=865504423.1702047637&ga_sid=1702047637&ga_hid=1441285274&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0L7Hz8QxSABSAghkEhkKCnB1YmNpZC5vcmcY0L7Hz8QxSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGM--x8_EMUgAUgIIZBIXCghydGJob3VzZRjQvsfPxDFIAFICCGQSFAoFb3BlbngYz77Hz8QxSABSAghkEhkKCnVpZGFwaS5jb20Y0L7Hz8QxSABSAghkEhsKDGlkNS1zeW5jLmNvbRjPvsfPxDFIAFICCGQ.&dlt=1702047636278&idt=1021&adks=3810924492&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0e59260c6a416d1eeb58e143a78d682756a37c15fcbcebe4bcdc1928f60e4eaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46336
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://helopal.club
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
12 KB 1088ms
1088ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2398167256370812&correlator=3481018421975161&eid=31079239%2C31078659&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=121764058%3A23001273585%2Chelopal.club%2Chelopal.club_o3b_display_sf_o3b&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C750x100%7C970x90&ifi=4&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1702047637338&lmt=1702047637&adxs=436&adys=1200&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fhelopal.club%2F&vis=1&psz=0x-1&msz=728x-1&fws=644&ohw=1600&ga_vid=865504423.1702047637&ga_sid=1702047637&ga_hid=1441285274&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0L7Hz8QxSABSAghkEhkKCnB1YmNpZC5vcmcY0L7Hz8QxSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGM--x8_EMUgAUgIIZBIXCghydGJob3VzZRjQvsfPxDFIAFICCGQSFAoFb3BlbngYz77Hz8QxSABSAghkEhkKCnVpZGFwaS5jb20Y0L7Hz8QxSABSAghkEhsKDGlkNS1zeW5jLmNvbRjPvsfPxDFIAFICCGQ.&dlt=1702047636278&idt=1021&prev_scp=hb_bidder%3Drubicon%26hb_adid%3D48b22b1fddcf1e1%26hb_pb%3D7.80&adks=3471947066&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3b466cd5a743f6332582f606f9706ffa324496c9241f9e1f14b37c8e07a93df6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12534
x-xss-protection: 0
google-lineitem-id: 6378824136
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138446278896
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://helopal.club
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
12 KB 1847ms
1847ms Fetch
text/plain 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2398167256370812&correlator=3481018421975161&eid=31079239%2C31078659&output=ldjh&gdfp_req=1&vrg=202312040101&ptt=17&impl=fif&iu_parts=121764058%3A23001273585%2Chelopal.club%2Chelopal.club_o3b_display_si_o3b_s1&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x600%7C300x300%7C200x600%7C120x600%7C160x600%7C250x250&ifi=5&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1702047637340&lmt=1702047637&adxs=1280&adys=161&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fhelopal.club%2F&vis=1&psz=0x-1&msz=300x-1&fws=644&ohw=1600&ga_vid=865504423.1702047637&ga_sid=1702047637&ga_hid=1441285274&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0L7Hz8QxSABSAghkEhkKCnB1YmNpZC5vcmcY0L7Hz8QxSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGM--x8_EMUgAUgIIZBIXCghydGJob3VzZRjQvsfPxDFIAFICCGQSFAoFb3BlbngYz77Hz8QxSABSAghkEhkKCnVpZGFwaS5jb20Y0L7Hz8QxSABSAghkEhsKDGlkNS1zeW5jLmNvbRjPvsfPxDFIAFICCGQ.&dlt=1702047636278&idt=1021&prev_scp=hb_bidder%3Drubicon%26hb_adid%3D4931ed91ecff2d1%26hb_pb%3D7.80&adks=1457638999&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93dd9a1b61205da94e0b142633b384b9c2c1fd2bcfdec60e74984cfae50aeaa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12530
x-xss-protection: 0
google-lineitem-id: 6373202822
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138446985826
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://helopal.club
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A0EB 6 KB
3 KB 221ms
86ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:37 GMT
expires: Sat, 07 Dec 2024 15:00:37 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 38ms
37ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-Z45V12ZWF9&gtm=45je3bt0v890424607&_p=1702047636536&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&_fid=fSxnALJVFUnbslbvNLAmo6&cid=865504423.1702047637&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1702047637&sct=1&seg=0&dl=https%3A%2F%2Fhelopal.club%2F&dt=Play%20Friendship%20Quiz%20-%20Helopal.club&en=page_view&_fv=1&_ss=1&_ee=1&ep.origin=firebase&tfd=1509
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Z45V12ZWF9&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
332 B 98ms
30ms XHR
application/json 54.220.142.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.220.142.223 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-220-142-223.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: e74ea66f1736299c8aa9124abed99d4aac26e0abdded8e09baf4820efd5b258c

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://helopal.club
cache-control: no-cache
x-server: 10.45.31.14
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
228 B 84ms
28ms XHR
text/plain 141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://helopal.club
date: Fri, 08 Dec 2023 15:00:37 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fhelopal.club%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fhelopal.club%2F&rid=esp&cc=1

85 B
193 B

116ms
116ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fhelopal.club%2F&rid=esp&cc=1
Requested by: Host: helopal.club
URL: https://helopal.club/
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 9d53c079d4f5d303cd726649f4db9c21b8cc06b9110a980b9c20d793d9a315d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-lA3QUCm8EsvR/BKoG/Ua3avPD/8"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://helopal.club
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Fri, 08 Dec 2023 15:00:37 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://helopal.club
location: /esp?url=https%3A%2F%2Fhelopal.club%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame EE27 15 KB
6 KB 47ms
17ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=helopal.club

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4563823fd629a48517c7feb8bf33640e12440e08bdde7a172ce477c2ddfc9c4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:36 GMT
server: Kestrel
server-processing-duration-in-ticks: 307728
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2

200

sid Show response
mug.criteo.com/ Frame EE27
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=helopal.club&sn=ChromeSyncframe&so=0&topUrl=helopal.club&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=MA6CLHxaQTR4RC9lRWt6SjluVGs1Q2hXWkxMaFdVbUZMUWRHN2EvUVJ1MzNTVXFBN1RkTUQzL2RwbmRFaEN2V3hlRldDUlROSGVzZ3dMWlgwN2Y4S3krVWgwTi9jWUFEVXVmb2o4Wno3NmFmTU5yMDN4Yi9kS0JZMzBYdD...

425 B
662 B

17ms
16ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=MA6CLHxaQTR4RC9lRWt6SjluVGs1Q2hXWkxMaFdVbUZMUWRHN2EvUVJ1MzNTVXFBN1RkTUQzL2RwbmRFaEN2V3hlRldDUlROSGVzZ3dMWlgwN2Y4S3krVWgwTi9jWUFEVXVmb2o4Wno3NmFmTU5yMDN4Yi9kS0JZMzBYdDl3TXFFSEJ1anZFSC9XNVJncUR0K2lPekNtbHJJRmJ5d0wvN2ZXaDF1QWF4MFNyRzNpQzA3eTdTYU9Qcm5DZkJTcXhFck82U0VIcTRpaXlFWCtXMjdOakVPSyswV01TeWlZb1RsWW9BY3QvQlF6TnVLUThzUHRkWGNrbmhOdXhDQlFQN1BxanBHT0xsSng2bzJRTUxHNXRwRmsvcm94Y1NEVnJSTGdzV1FmVTh2RGx5Qm1yRT18&cppv=2

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

0622f12b7efe23ffb940a420521eb6f170060657f51d81637cd14d21ecedad78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1448302
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=MA6CLHxaQTR4RC9lRWt6SjluVGs1Q2hXWkxMaFdVbUZMUWRHN2EvUVJ1MzNTVXFBN1RkTUQzL2RwbmRFaEN2V3hlRldDUlROSGVzZ3dMWlgwN2Y4S3krVWgwTi9jWUFEVXVmb2o4Wno3NmFmTU5yMDN4Yi9kS0JZMzBYdDl3TXFFSEJ1anZFSC9XNVJncUR0K2lPekNtbHJJRmJ5d0wvN2ZXaDF1QWF4MFNyRzNpQzA3eTdTYU9Qcm5DZkJTcXhFck82U0VIcTRpaXlFWCtXMjdOakVPSyswV01TeWlZb1RsWW9BY3QvQlF6TnVLUThzUHRkWGNrbmhOdXhDQlFQN1BxanBHT0xsSng2bzJRTUxHNXRwRmsvcm94Y1NEVnJSTGdzV1FmVTh2RGx5Qm1yRT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 283171
content-length: 0
expires: 0

GET
H2 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 9589 67 B
196 B 182ms
67ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1696164081359292&output=html&h=280&slotname=3067619107&adk=2984494112&adf=54630664&pi=t.ma~as.3067619107&w=1200&fwrn=4&fwrnh=100&lmt=1702047636&rafmt=1&format=1200x280&url=https%3A%2F%2Fhelopal.club%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702047636616&bpp=2&bdt=338&idt=292&shv=r20231206&mjsv=m202312040101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2867536099469&frm=20&pv=1&ga_vid=865504423.1702047637&ga_sid=1702047637&ga_hid=1441285274&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=4386&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079865%2C31079921%2C42531705%2C44809005%2C95320229&oid=2&pvsid=2398167256370812&tmod=1911696006&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEebr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=295

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 17:28:07 GMT
x-content-type-options: nosniff
server: cafe
age: 77550
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67
x-xss-protection: 0
expires: Fri, 08 Dec 2023 17:28:07 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 1E08 0
167 B 59ms
20ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Fri, 08 Dec 2023 15:00:37 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 e21910fd923a6283b5d44b2382eabc86.js Show response
www.gstatic.com/mysidia/ Frame C39F 9 KB
4 KB 165ms
54ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e21910fd923a6283b5d44b2382eabc86.js?tag=client_fast_engine_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27d5ba2175dc395614adb2c69fe9f4bff9abddef3a7c6e3e30a68587f428a37b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:44:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209785
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4064
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:44:12 GMT

GET
H3 200 f3d12415f986ed3504122551351bc1d0.js Show response
www.gstatic.com/mysidia/ Frame C39F 42 KB
16 KB 180ms
70ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f3d12415f986ed3504122551351bc1d0.js?tag=html5_display_upload/html5_exit_api

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5bcc597ce8a3ec0c0ef52ee8ece8f284ca9739c1bd1bbac380a3deb672d5446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:44:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209785
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16637
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:44:12 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame C39F 2 KB
875 B 121ms
78ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 18:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72325
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 18:55:12 GMT

GET
H3 200 50459845d1cbd526a76ea757de42d266.js Show response
www.gstatic.com/mysidia/ Frame C39F 23 KB
10 KB 167ms
59ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/50459845d1cbd526a76ea757de42d266.js?tag=exit_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9caffafcdae7b42e3d074103c18a33640d4edf81401c216e99dbb77a15dfa511

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:44:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209785
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9842
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:44:12 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame C39F 24 KB
9 KB 111ms
68ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 18:54:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72354
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 18:54:43 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame C39F 3 KB
1 KB 122ms
79ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 09:15:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 20697
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:15:40 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame C39F 20 KB
9 KB 102ms
59ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 18:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72325
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 18:55:12 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame C39F 202 KB
64 KB 212ms
97ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Dec 2023 15:00:37 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame C39F 37 KB
15 KB 197ms
90ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:44:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209789
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:44:08 GMT

GET
H2 200 container.html Show response
559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6DC4 6 KB
3 KB 52ms
51ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:37 GMT
expires: Sat, 07 Dec 2024 15:00:37 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8866463111437598340/ Frame 28C6 87 KB
19 KB 55ms
55ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8866463111437598340/index.html

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/f3d12415f986ed3504122551351bc1d0.js?tag=html5_display_upload/html5_exit_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85cbceaafb359c2c5a430bf996580c9269ca94b2fd643df5816fca8796e7d5d0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1548
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 17589
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 14:34:49 GMT
expires: Sat, 07 Dec 2024 14:34:49 GMT
last-modified: Fri, 11 Aug 2023 08:12:20 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 367A 624 B
242 B 93ms
93ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COO1YRDml88BGKaltfcBMAE&v=APEucNVI1gTlrPIQNQ4qq8YiK37d6TUTcN3qYpN2sWzQsAjdlpTsqTwzuITj-xpxoAEZnJpVAiAlsydZHteVnOLRXFMZbyt5ewQcf5HtRksZTtuYWmeo7x9chkQCcH9-xM69Lv1XqEkTyOMJcgPQHWCmnO3vZe8GX62tzaXFwlmpKv_i73LNPG44oeLQ2biICuNtYXywwMsOrupS10IorBvqCjtoh9RcRw

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 6DC4 111 KB
39 KB 168ms
53ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Origin: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 19:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68952
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 08 Dec 2023 19:51:26 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame 6DC4 7 KB
3 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 19:08:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71548
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 19:08:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 6DC4 24 KB
9 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 19:00:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72037
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 19:00:00 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 6DC4 41 KB
14 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 593729
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 6DC4 3 KB
1 KB 73ms
73ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 09:15:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 20697
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 09:15:40 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0FC3 1 KB
643 B 52ms
51ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 71598
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 19:07:19 GMT
etag: 48472445140208031
expires: Fri, 08 Dec 2023 19:07:19 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 6DC4 20 KB
8 KB 74ms
74ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 18:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72325
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 18:55:12 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6DC4 42 B
63 B 87ms
85ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DZuKIg2k2JE7YjdZWTEj9GIKI1Br1iSPb3_bs0GJjtTOYwjMocFZCtgOZK2lD51-sGz3zzTmR5GSM8lPIy37GOSUZesTas3O-bUCygItuTyck-WIc

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 6DC4 0
0 180ms
62ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQqpErxsJwmnbyJr1a5r9M47dbOCuyMqMoSQFkz3BZl17xarUmTXpr3ITzFQlP7P60_UEUKU8RGsQgE4I8rMXq3kpO0pQ
Requested by: Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6DC4 202 KB
64 KB 99ms
98ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Dec 2023 15:00:38 GMT

GET
DATA 200
OK truncated
/ Frame C39F 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2a4f81bfb6ea085da3920d788715bfd3e3e43f0737cb1f871be910b77bb47d8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 28C6 16 KB
6 KB 68ms
66ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8866463111437598340/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8866463111437598340/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 07:13:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5660
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 09 Dec 2023 07:13:23 GMT

GET
H2 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 28C6 34 KB
13 KB 56ms
54ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8866463111437598340/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8866463111437598340/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 19:07:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71598
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 08 Dec 2023 19:07:20 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 0FC3
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDZlZDhA3pXqMP0N1p1p4Uc&google_cver=1&google_push=AXcoOmTia-CBq4nU2yhEIwq7Zq0mCxUIYpGPa_eiT9zQjv7szp3WeqDJr1vkH26uemt_3nU1Rkz6In6-tdu7psX8OrlIMQvQT3useQ
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzc5MTExOTQ3NDY2Njc3NDcxMQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDZlZDhA3pXqMP0N1p1p4Uc&google_cver=1

43 B
398 B

16ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDZlZDhA3pXqMP0N1p1p4Uc&google_cver=1
Requested by: Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 08 Dec 2023 15:00:37 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDZlZDhA3pXqMP0N1p1p4Uc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 0FC3
Redirect Chain

https://ums.acuityplatform.com/tum?umid=4&uid=CAESEBJ2w9rC19yGH3WR51Jnb-8&google_cver=1&google_push=AXcoOmRBfFppHtCIpxLGMJ8N0J_ucpBIu5lowZy9vWA3y6uYarxy2PWmkud4jUr8K4aCKLTubGlO5aU30XLSgAC1pnpPd7iIWW4Z
https://cm.g.doubleclick.net/pixel?google_nid=acuity&google_hm=862055548164&us_privacy=1---

170 B
232 B

81ms
53ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=acuity&google_hm=862055548164&us_privacy=1---

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=acuity&google_hm=862055548164&us_privacy=1---
content-length: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 0FC3
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSfAZ...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-cMafUhNvb4TX_w_vRfud4fN8KwvK9gjGyvCmcg&google_push=AXcoOmSfAZr8XX-WFE4KT4AfYKUV7C8dosK545gkxSMoZfmJx5vuc_D0x9g1NCz4i_qtsTJBHQQJyItCRrm_...

170 B
243 B

78ms
47ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-cMafUhNvb4TX_w_vRfud4fN8KwvK9gjGyvCmcg&google_push=AXcoOmSfAZr8XX-WFE4KT4AfYKUV7C8dosK545gkxSMoZfmJx5vuc_D0x9g1NCz4i_qtsTJBHQQJyItCRrm_6t_A4kLZIHJW4jDN2A

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k-cMafUhNvb4TX_w_vRfud4fN8KwvK9gjGyvCmcg&google_push=AXcoOmSfAZr8XX-WFE4KT4AfYKUV7C8dosK545gkxSMoZfmJx5vuc_D0x9g1NCz4i_qtsTJBHQQJyItCRrm_6t_A4kLZIHJW4jDN2A
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 918650
content-length: 0
expires: Fri, 08 Dec 2023 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 0FC3 43 B
236 B 54ms
19ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPh-j04kpOhW6yv98KCOog0&google_cver=1&google_push=AXcoOmT1q750KLyPb3wjn6NQzMIWlapjVQpsf0B0Du25saKuOnxoXriWzIKx1YvIptvA1vkLAslnmejYJRAcBFQHUhEfrIepHWkvdA
Requested by: Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 0FC3
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEGtWLncXG5nY5ES6hc4zJNQ&google_cver=1&google_push=AXcoOmQNcNFxrapvP1w-QBRDMT95CaRyKnr03uJ8gMZCSWwdcaao-pF0Mn1S5kCxOWHxyeduRo2fqgmfREvdUSyP4x5Ixlk_OuTUsg
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AXcoOmQNcNFxrapvP1w-QBRDMT95CaRyKnr03uJ8gMZCSWwdcaao-pF0Mn1S5kCxOWHxyeduRo2fqgmfREvdUSyP4x5Ixlk_OuTUsg&google_hm=M3ptbVZlZWtreGV2Y2...

170 B
232 B

48ms
48ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AXcoOmQNcNFxrapvP1w-QBRDMT95CaRyKnr03uJ8gMZCSWwdcaao-pF0Mn1S5kCxOWHxyeduRo2fqgmfREvdUSyP4x5Ixlk_OuTUsg&google_hm=M3ptbVZlZWtreGV2Y2tJVHhaUkQ=

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=AXcoOmQNcNFxrapvP1w-QBRDMT95CaRyKnr03uJ8gMZCSWwdcaao-pF0Mn1S5kCxOWHxyeduRo2fqgmfREvdUSyP4x5Ixlk_OuTUsg&google_hm=M3ptbVZlZWtreGV2Y2tJVHhaUkQ=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H/1.1 200
OK pub
cs.chocolateplatform.com/ Frame 0FC3 0
134 B 303ms
100ms Image
text/plain 159.203.145.121
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEMD54A6Vy2ucvOAmWYIZzu4&google_cver=1&google_push=AXcoOmTdwklE9biKD0AQmF9l0I9mvzdSSTACnPrsGYARI7_Se8tMG03VpzlE6r4HmnIC6Av_VQ7J8Iruxlh5QRetwc4NQe6DPWqiIw
Requested by: Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 159.203.145.121 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: CookieSync Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 08 Dec 2023 15:00:37 GMT
server: CookieSync Server
content-length: 0

GET
H2

200

0.gif
id5-sync.com/i/495/ Frame 0FC3
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEJX9RQf2TzNvhwzBhF_oqlI&google_cver=1&google_push=AXcoOmS5L50uX35lWDbl-yf34HWibsmzwhhx5pqLgxN985fkt01PuGwLaatb3WzwI3dtHFUiOSRfAZeeICULnD80LcjMcazN0CM2itI
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmS5L50uX35lWDbl-yf34HWibsmzwhhx5pqLgxN985fk...

43 B
921 B

21ms
7ms

Image
image/gif

141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmS5L50uX35lWDbl-yf34HWibsmzwhhx5pqLgxN985fkt01PuGwLaatb3WzwI3dtHFUiOSRfAZeeICULnD80LcjMcazN0CM2itI

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Fri, 08 Dec 2023 15:00:37 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

Redirect headers

date: Fri, 08 Dec 2023 15:00:38 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmS5L50uX35lWDbl-yf34HWibsmzwhhx5pqLgxN985fkt01PuGwLaatb3WzwI3dtHFUiOSRfAZeeICULnD80LcjMcazN0CM2itI
x-download-options: noopen
vary: Accept
content-length: 274
x-xss-protection: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 0FC3 0
59 B 130ms
52ms Image
text/html 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LC0fmna_Uf5qLPyQeIhA6PcVF_zCd-vV0eyUaxK30wFu8zkqPRJVaVzY2R79vJl_r9Ly2gbQ

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 46D9 38 KB
13 KB 53ms
53ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 280153
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 09:11:25 GMT
expires: Wed, 04 Dec 2024 09:11:25 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 367A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDsui0N56Y2pW9-U5Ys8q-g&google_cver=1

43 B
775 B

32ms
32ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDsui0N56Y2pW9-U5Ys8q-g&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COO1YRDml88BGKaltfcBMAE&v=APEucNVI1gTlrPIQNQ4qq8YiK37d6TUTcN3qYpN2sWzQsAjdlpTsqTwzuITj-xpxoAEZnJpVAiAlsydZHteVnOLRXFMZbyt5ewQcf5HtRksZTtuYWmeo7x9chkQCcH9-xM69Lv1XqEkTyOMJcgPQHWCmnO3vZe8GX62tzaXFwlmpKv_i73LNPG44oeLQ2biICuNtYXywwMsOrupS10IorBvqCjtoh9RcRw
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7v5W%2B%2BiN44CKqfGF%2BFrUdltZpv83iClm428ib%2BQJufN86yzU2I8Z%2BV1dya5DdVPaQPk4D3UexX%2FEBNq2qIdHutsdr6Xlvl5KNyaWYXIWYXaf%2B2LhMbsyf8NnfEJYvAyQx5U5dRTkKsv2GA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8325e10a799665d4-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDsui0N56Y2pW9-U5Ys8q-g&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 367A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXMvluj9bPEAuhYV6-22OwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDsui0N56Y2pW9-U5Ys8q-g&google_cver=1

43 B
735 B

31ms
30ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDsui0N56Y2pW9-U5Ys8q-g&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COO1YRDml88BGKaltfcBMAE&v=APEucNVI1gTlrPIQNQ4qq8YiK37d6TUTcN3qYpN2sWzQsAjdlpTsqTwzuITj-xpxoAEZnJpVAiAlsydZHteVnOLRXFMZbyt5ewQcf5HtRksZTtuYWmeo7x9chkQCcH9-xM69Lv1XqEkTyOMJcgPQHWCmnO3vZe8GX62tzaXFwlmpKv_i73LNPG44oeLQ2biICuNtYXywwMsOrupS10IorBvqCjtoh9RcRw
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BFeqfMaO3YkI4OL47SCznB1jmS3IcZThWeFBXqhvlfZDXF9WtTmuZo3nIQQiD7GfU%2FWbxiGOAJIsiX6chlJzzApX%2Baa0IPUK%2Fd4XgmHhGOMl3r0QFzCU7MkHo6O7YdTFMOlnAPGayNFpeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8325e10b0a6c65d4-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDsui0N56Y2pW9-U5Ys8q-g&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 367A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELjzhzduINpfKYtSpLQK-UQ&google_cver=1

43 B
845 B

15ms
13ms

Image
image/gif

185.89.210.122
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESELjzhzduINpfKYtSpLQK-UQ&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COO1YRDml88BGKaltfcBMAE&v=APEucNVI1gTlrPIQNQ4qq8YiK37d6TUTcN3qYpN2sWzQsAjdlpTsqTwzuITj-xpxoAEZnJpVAiAlsydZHteVnOLRXFMZbyt5ewQcf5HtRksZTtuYWmeo7x9chkQCcH9-xM69Lv1XqEkTyOMJcgPQHWCmnO3vZe8GX62tzaXFwlmpKv_i73LNPG44oeLQ2biICuNtYXywwMsOrupS10IorBvqCjtoh9RcRw

Protocol

Server

185.89.210.122 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
an-x-request-uuid: c47da896-7b1d-45c6-a845-d1e0925e034b
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 185.213.155.153; 185.213.155.153; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESELjzhzduINpfKYtSpLQK-UQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 367A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTEwODEzMjIyMDcyNTQ3Njk3NA%3D%3D

170 B
232 B

46ms
45ms

Image
image/png

172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTEwODEzMjIyMDcyNTQ3Njk3NA%3D%3D

Requested by

Protocol

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-17-48-145.eu-west-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
an-x-request-uuid: 4b37cac7-c176-4890-b95a-3ab8fe5d31fa
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTEwODEzMjIyMDcyNTQ3Njk3NA%3D%3D
x-proxy-origin: 185.213.155.153; 185.213.155.153; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 6DC4 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc410cf6750249cfbe5c6c2b1e37a11d399d97261da2b05f927beb7b52908295

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame C39F
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=Cf0iIlC9zZYL_OfuVjuwP55-1qAa02ty-dNO248jyEcCNtwEQASDJtI5-YJXikIKgB6AB1tva_ALIAQmpAkTJ7AB4LoE-qAMByANIqgTMAU_Q_v3750MIfA5YSGFk74ja2vbkcKaWFmyaNSA...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%224702845543093533744%22,%22debug_reporting%22:true,%22destination%22:%22https://4kzgame.com%22,%22event_report_window%22:%2...

0
0

149ms
71ms

Fetch
text/css

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%224702845543093533744%22,%22debug_reporting%22:true,%22destination%22:%22https://4kzgame.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22798404054%22],%224%22:[%2212-08%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225219894138770725905%22}&andc=true

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"4702845543093533744","debug_reporting":true,"destination":"https://4kzgame.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["798404054"],"4":["12-08"],"6":["true"]},"priority":"500","source_event_id":"5219894138770725905"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 08 Dec 2023 15:00:38 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"4702845543093533744","debug_reporting":true,"destination":"https://4kzgame.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["798404054"],"4":["12-08"],"6":["true"]},"priority":"500","source_event_id":"5219894138770725905"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame 3A8F 51 KB
19 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 10:31:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275343
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 10:31:35 GMT

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame 28C6 51 KB
19 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 10:31:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275343
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 10:31:35 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 46D9 39 KB
15 KB 75ms
74ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 14:57:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 203
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 14:57:15 GMT

GET
H3 200 320x50-IHG-EN.html Show response
s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/ Frame 6497 6 KB
2 KB 204ms
93ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/320x50-IHG-EN.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6707e35e9d8bc09af866d0a7a34308cea6045dfd5afcc9ae36427e612a312e36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 156467
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2388
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 19:32:51 GMT
expires: Thu, 05 Dec 2024 19:32:51 GMT
last-modified: Fri, 22 Sep 2023 14:31:22 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 6DC4 0
0 177ms
85ms Fetch
image/gif 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuiUwILavqlZXMC2sqFs76FkLURiuedjM1gDeCoJe_kkHUZe42dok__Myf8sOJKwM1FmR5bsKeFr7vQtWgdfeT2-qqwi2JC6LpfuJ8ywxY7Er9V2TE66xyrH5swnhVz7Sx9lyQwuDfi5-p4WKEHB1fd4d-01wcRIkW5swCNKGVT3UDiUXevll3paaFW8su1vuk7o265RbqN8ehNLGObKHgtyXMcCN-NKn7S57augNYLlYVI-dF8VITFT6AMGFLkwl0-0Vq7f_dakcjg4Zjod19-RM1U0xAiDNnYWmgcjm83P3gi4ZxmEzhBVOXrFOvT7QUE5_pD1Kd-DlkY2G5rweHuzRB-vOIF8Hi7C8W4TEvWQYbYsBKy1WpqImEemxsEo49HY-oRgrjJrqoti791IPs0OGDLaT7swGETt7be5EB2_Ulr5dXEmAUzL7rW-swYfcTh0ikUpK6ZhLfv73-Wbsvw73pcdnGgAt8DFEye-3VYZjAl6SsA2FzzzRrAmQW1j0PjANer_5uL91nivodL1fPCS3fFnuK_YmA0yVCNHll-lGH3ljAwjTNWWmv6jNFiR8o-NtFsnU7sekXwKicuPia63OHIMFEHUnsYTviczOiLJUZVusVPzPPGZLdHDjoB-I9Z99PnBnlEB7IJqzmm06E1xyU4mDDkTJvxrvYKC5x_UJ5wf2RngSrS6MBDwsXhL1oYmMTogezwNuI55sYIf5yZ3Q6Ut9iPkDAb-Q5g5zeUXtWc4NZXVQNE4eFRQ28eaKRNrsatH7HJxhD2HNNInaA_XXwsu0BbuOzKC6j-ZSO3yI1iR9A7Fb0xaYM3UJxk1ZctySVlFpuXdrH5Tz4AOx0-SB_MhWIhIQAlpG9cW8cURBJY8GaqR3uK9JTi-mRQnDMGwDwxelPTBT94X4oZq3GCsOBlkKZglr87NkxLvogMnV4meqYBws7Vmc4rSq0w5I6dDCWvK6IBrIBJtuqmq1fOw-j-cYk-b_NGIVykA7lsEMwGWdKehxAZ2vKpDYqLfBDUKfjeQNf-LKgG1hGdahwJqbstDPvAJ8lFojKtHuqwoB-dZgWhzFTXetRlmTneMFx8QT9MMtwDMukYaW7LZyiBoWZYuWErx7FxorbZ53BZj5WfwJ-gwbrD9gN-0nDunNlx4RsQmVRZZRf1fZ530F9jnXOcuNEGtCKZM1u9fLNgDdXLi8IsAOoITiWsEEURgtr0DVaDA4rH_MWWT-d5djPJZKCoyQLdekuB3BbdNJa-QRIZMX0UY4h2KNdPSWgxibtTMvzPuUdX-wPpylNsChY6aEucUEkDZDvvE2Lwg_NX9NjzRIsnKMFli6ououALDlF5wla4aQL4H7-JortfxJPncI6uV2mhbAkL1esHsNLhopcYos-KvnM&sai=AMfl-YRu3vcYyF232IKMTXR-J49IDtwjf5HiZe8LoBlYTCdpJ3v6sQnFxae66b7WnLxl5QkNicdTa_pX0W_EC-Bt_hzMIU2z11hUFGL1oAOMzYB5vyaFxu2dz-r04SZRrzMfhFjmMcvoZOEhAJdXLLO1F57M5Pl2VYMH8RukvIMfIYF0IbfNT9edvTJmtZJVJrgrvLNlyYy2Ely_L2lDU2EmaVshsmRJV38Kp-CsV6lDIMaCE12iPRlXoA2xlohW_Xjin9wIOj4XK6V4jBZKszKCB46LbAqewjmyo5ChRs3k9eCzjv8jFhGwC14L5vXRFq5YCHhIBFS0s6XxKxBFCLyvrxhITxiesCHF3u6SF1Xtip9p1PBGHYEVvxdxtigkIx7AE9FhmLVlnSbcDFETNLWGfXGj_RI4gUcwrjCeRZY_2RZZ30cospKc0Q&sig=Cg0ArKJSzJUjj9_asUbDEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9paGcuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=240&cbvp=1&cstd=238&cisv=r20231206.65127&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

firstevent
ihg.demdex.net/ Frame 6DC4
Redirect Chain

https://ihg.demdex.net/event?d_event=imp&d_src=17025&d_creative=199600097&d_adgroup=567519347&d_placement=375997312&d_site=3439440&d_campaign=30519982&d_cb=2120323161
https://ihg.demdex.net/firstevent?d_event=imp&d_src=17025&d_creative=199600097&d_adgroup=567519347&d_placement=375997312&d_site=3439440&d_campaign=30519982&d_cb=2120323161

42 B
716 B

33ms
32ms

Image
image/gif

52.17.48.145
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ihg.demdex.net/firstevent?d_event=imp&d_src=17025&d_creative=199600097&d_adgroup=567519347&d_placement=375997312&d_site=3439440&d_campaign=30519982&d_cb=2120323161

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

52.17.48.145 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v054-08513f95b.edge-irl1.demdex.com 4 ms
pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: 0FdLJkcvR/4=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v054-0994aa89c.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: YCyrqzmHQ1g=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://ihg.demdex.net/firstevent?d_event=imp&d_src=17025&d_creative=199600097&d_adgroup=567519347&d_placement=375997312&d_site=3439440&d_campaign=30519982&d_cb=2120323161
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 154ms
70ms Preflight
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 08 Dec 2023 15:00:38 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 46D9 0
20 B 88ms
88ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B12pclS9zZb38GPza1PIP-L6RsA8AAAAAOAHgBAI&bg=!2tml2ZbNAAY3kmNgF5I7ADQBe5WfOIdziPIMJhG0gSZzpeFFHiQ36t01_kNdNIdth13Aw2nl7AE5ZaoNCwDRQCvQXlrjAgAAAEJSAAAAAWgBBwoAEB6spzvonjMj95IEWacryHGZAy3WGPtORswA73guJNU9FU_kqzwHNMz8RPXE3HYyW-wWL5xllj16qZVDjXjw6arqNFKJVB895d_31GsloSNuEYAIKqEvdcVCbpRguZjjNPO_RugVjEweaAh8kt1uTjv-SwS_xx20uGk0hVRGyGxyPN3f2iGcGVbEhDpZd2ANjJAwAnlII_8VmuT_utTuqw4sSPNNcntGelS7iGyS3RrsoNEJGGhyQDC_e70gSIUA7cL6wk3F23VwBiVIv1MFq-fZ2-N7N3lyTRt80RDeTAW04lWEpjd4u0WcHE7nMQ1qvnB7cGPZpRMPssAepPH7wrQy5efyE9k1spmWiFmrrTAHkU8exfaiAKQemBy6TMCHk03JhhDWJJNQqRI89LBLwpShRApZeyju4iVrD_NAuQyAFK5KSBBpA83Ruh4SjxcY9jTQ6exmA7H4RaORMhUR3xznNtbWFTfO8QvQ4qKZ9Qn3_XEY_BuhzM5j-yOAWLBRWHWldxE9QWfzBslm3ySsEMB-7Hdd6TGtfx_tMBiVVM8UhSXvJ1eYBhuQVH-fBO4ZyBrhCIr2h-gI3YRd-880lHMiTH-FZL5PLJma8A8_t24oUfdai2lmaHRHL3jP16DuSWr9P1ksqxw0VPMg0MnQ7IF6b2e5G4I0cK1Ntbq4f94KKv3t93bnOoLcRrHHyzbL_20XqSGnADbCaJc3ri0fz1ES5XJkIqnn190a5tn9WGLnKWYZv--E5jbDjEznNqfTG88EI7JNnWbKo7ZG5BusuWNQ1O9ReFyq6Bmt1s1G-bJSuQT8VXcZBr6ftorS0ilrjMN_KCyovHrr6AFb5kU0_7WNZ0QMFRKiriVrRvKiV79IhK2VQxBjK59XGHhJ-Is_X-IrbQX3DNr3-wZcHxiOl2m-adJuu5oktYrwhddRJlDYk2nUsN_3MlI6rYSIjEbWN3yz2w077H5pWp3GX17M3Wl6uYGp9lR7IkpPMFgU0H9D5w8S4eW_SETXBGw4Uu3X3HC30j-A43805STFEoI-0P5VH9ft6DXf_hM-wjjbD9vYZKtYDLQcObfYo7vRJRy3gvYMofSmMPhzaT7JlDOdXfU

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 6497 236 KB
63 KB 41ms
16ms Script
text/javascript 2a02:26f0:480:f::213:7ed6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/320x50-IHG-EN.html?ev=01_250
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:480:f::213:7ed6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=900
x-n: S
accept-ranges: bytes
expires: Fri, 08 Dec 2023 15:15:38 GMT

GET
H3 200 320x50-IHG-EN-template.js Show response
s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/ Frame 6497 28 KB
5 KB 62ms
62ms Script
application/x-javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/320x50-IHG-EN-template.js?1643315046007

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/320x50-IHG-EN.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37347237fd275e5e05d7da1ba74a92a06c58c89ce83a52f376f9971c5a34d111

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/320x50-IHG-EN.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 16:38:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 166905
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5467
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 14:31:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Dec 2024 16:38:53 GMT

GET
H3 200 container.html Show response
559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 31A2 6 KB
3 KB 55ms
54ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:37 GMT
expires: Sat, 07 Dec 2024 15:00:37 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 _320x50stroke.png
s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/images/ Frame 6497 267 B
294 B 60ms
60ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/images/_320x50stroke.png?1695325265896

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af27fd178a5afc293b54611bb56408ee12491b153053bd7709f754abe00d1c57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/320x50-IHG-EN.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 20:50:20 GMT
x-content-type-options: nosniff
age: 583818
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 267
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 14:31:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Nov 2024 20:50:20 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 6DC4 0
0 78ms
78ms Fetch
image/gif 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuiUwILavqlZXMC2sqFs76FkLURiuedjM1gDeCoJe_kkHUZe42dok__Myf8sOJKwM1FmR5bsKeFr7vQtWgdfeT2-qqwi2JC6LpfuJ8ywxY7Er9V2TE66xyrH5swnhVz7Sx9lyQwuDfi5-p4WKEHB1fd4d-01wcRIkW5swCNKGVT3UDiUXevll3paaFW8su1vuk7o265RbqN8ehNLGObKHgtyXMcCN-NKn7S57augNYLlYVI-dF8VITFT6AMGFLkwl0-0Vq7f_dakcjg4Zjod19-RM1U0xAiDNnYWmgcjm83P3gi4ZxmEzhBVOXrFOvT7QUE5_pD1Kd-DlkY2G5rweHuzRB-vOIF8Hi7C8W4TEvWQYbYsBKy1WpqImEemxsEo49HY-oRgrjJrqoti791IPs0OGDLaT7swGETt7be5EB2_Ulr5dXEmAUzL7rW-swYfcTh0ikUpK6ZhLfv73-Wbsvw73pcdnGgAt8DFEye-3VYZjAl6SsA2FzzzRrAmQW1j0PjANer_5uL91nivodL1fPCS3fFnuK_YmA0yVCNHll-lGH3ljAwjTNWWmv6jNFiR8o-NtFsnU7sekXwKicuPia63OHIMFEHUnsYTviczOiLJUZVusVPzPPGZLdHDjoB-I9Z99PnBnlEB7IJqzmm06E1xyU4mDDkTJvxrvYKC5x_UJ5wf2RngSrS6MBDwsXhL1oYmMTogezwNuI55sYIf5yZ3Q6Ut9iPkDAb-Q5g5zeUXtWc4NZXVQNE4eFRQ28eaKRNrsatH7HJxhD2HNNInaA_XXwsu0BbuOzKC6j-ZSO3yI1iR9A7Fb0xaYM3UJxk1ZctySVlFpuXdrH5Tz4AOx0-SB_MhWIhIQAlpG9cW8cURBJY8GaqR3uK9JTi-mRQnDMGwDwxelPTBT94X4oZq3GCsOBlkKZglr87NkxLvogMnV4meqYBws7Vmc4rSq0w5I6dDCWvK6IBrIBJtuqmq1fOw-j-cYk-b_NGIVykA7lsEMwGWdKehxAZ2vKpDYqLfBDUKfjeQNf-LKgG1hGdahwJqbstDPvAJ8lFojKtHuqwoB-dZgWhzFTXetRlmTneMFx8QT9MMtwDMukYaW7LZyiBoWZYuWErx7FxorbZ53BZj5WfwJ-gwbrD9gN-0nDunNlx4RsQmVRZZRf1fZ530F9jnXOcuNEGtCKZM1u9fLNgDdXLi8IsAOoITiWsEEURgtr0DVaDA4rH_MWWT-d5djPJZKCoyQLdekuB3BbdNJa-QRIZMX0UY4h2KNdPSWgxibtTMvzPuUdX-wPpylNsChY6aEucUEkDZDvvE2Lwg_NX9NjzRIsnKMFli6ououALDlF5wla4aQL4H7-JortfxJPncI6uV2mhbAkL1esHsNLhopcYos-KvnM&sai=AMfl-YRu3vcYyF232IKMTXR-J49IDtwjf5HiZe8LoBlYTCdpJ3v6sQnFxae66b7WnLxl5QkNicdTa_pX0W_EC-Bt_hzMIU2z11hUFGL1oAOMzYB5vyaFxu2dz-r04SZRrzMfhFjmMcvoZOEhAJdXLLO1F57M5Pl2VYMH8RukvIMfIYF0IbfNT9edvTJmtZJVJrgrvLNlyYy2Ely_L2lDU2EmaVshsmRJV38Kp-CsV6lDIMaCE12iPRlXoA2xlohW_Xjin9wIOj4XK6V4jBZKszKCB46LbAqewjmyo5ChRs3k9eCzjv8jFhGwC14L5vXRFq5YCHhIBFS0s6XxKxBFCLyvrxhITxiesCHF3u6SF1Xtip9p1PBGHYEVvxdxtigkIx7AE9FhmLVlnSbcDFETNLWGfXGj_RI4gUcwrjCeRZY_2RZZ30cospKc0Q&sig=Cg0ArKJSzJUjj9_asUbDEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9paGcuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=514&vt=11&dtpt=274&dett=3&cstd=238&cisv=r20231206.65127&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 31A2 24 KB
6 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:25:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 318924
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 03 Dec 2024 22:25:14 GMT

GET
H3 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame 31A2 26 KB
10 KB 23ms
23ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f85637bbf5c0ee6a01fa5afb711af0e3d873ab20f0cbeaeb9105998530822c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3519
x-jsd-version: 1.16.0
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230067-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"6721-FSYTlyriJmmnEqYsq5KQLDRsrFg"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qwMdk4brEBoonKFXY7LYxk0FVSnVJEb0CQQ2Ewtug8NqUg4QMwkp4uCvTUyZraQPssIvq0ty6JcdAAvxEXBNH6gMmGO1Z480triVStd4yNykVC3poRl6xSdmsjEdpyAjpKJ3pcmJRLHteeAJVO0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8325e10ca8831c19-FRA

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 31A2 202 KB
64 KB 99ms
99ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Dec 2023 15:00:38 GMT

GET
H3 200 HIlogovert.png
s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/images/ Frame 6497 7 KB
7 KB 63ms
63ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/images/HIlogovert.png?1695325265896

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f98cfe6d95e7ca6c6d14d3b34d959052eee1ed7160418d5e3922aeed6f9acd46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6611297739646959616/320x50-HI-DE-refreshed/320x50-IHG-EN.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 23:41:42 GMT
x-content-type-options: nosniff
age: 314336
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7390
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 14:31:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 23:41:42 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 31A2 0
0 94ms
94ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvlE_6OQC_J2XHwfBGyxZqKHXnxW3OaqMQuq9JAcXCg-tjGLo-yjxGWvwWAk2AbisGtSFB4IvrNtxp_YqaSBY0AmFUX7m4JT_8XqC0XMH2J8-Iyin5uh67vfMlaa3IULzybRNc1XN7i6Qm8TY8k-iRT8Bsb7E3XRFfiisfDXZIYJDZB6iwhrpHntMmUvSFPYHKBhbT4JXy6tYyK8e0JsR9jekUaWkCYUDHo4inU1hefdKSP7KE45Oay-pr5i52C02V03U7mHuXX7YkWEnqHp2D1eQVFFIaUzmcJ_D6PnGFistaRR_27zOV9U2zLZiZfr3iU9CmGNwxMsLtlcEpkA2bCEtDcD6ocxvOOHAPWKRZDSEte1Wj3_TwW7xKphlhdc1QNT1PAb7jp4zac6H8&sai=AMfl-YQ_au4P6bl8p9BoZWxc7Nl0zTjHpyp4EPOVxBd_5pY3W95g_HZUUXNHxxnFwp4Lx7rnZ9nkpJtPzUEIKEi3sj2VvuhjQIVpjqfe80STXAO9MFeWW6mWIY3NJ9YNWKz-Rf-7LIjYz-9XEg&sig=Cg0ArKJSzMSs0h8gXuT6EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BADC 281 B
124 B 93ms
93ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKijpQIQ2M6oAhiK2LJvMAE&v=APEucNV133zMeCJ1J8S64L_mC42wS7jusH2aBTJZd4xFNk8eAsosgQrhshyVxCICH2cHIcJ4iRa6cfG2oC4scuq1vwI8cZifisA4v73Af1EgbOBqnUByU_Y

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a0f95dcad4811c2b85289326687f5e63764a1a24b5f8bd2d4ad59da3858f7992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 104
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame E701 89 KB
31 KB 188ms
187ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 08 Dec 2023 15:00:38 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E701 42 B
63 B 87ms
86ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BrcTO5T9r0Ss_ss0SZ0to4pnnPu016rkdFqGCG-uMWpXfZxCLIJraIuCQtdSDt0yjuYyKU7-4cgenN0AXuPsAqOeqdDM-sA5nhSB2wtH0U3W65Lks

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 606a40a2-0a69-46cb-9863-1021de7a5f6a
beacon-ams3.rubiconproject.com/beacon/d/ Frame E701 43 B
227 B 148ms
19ms Image
image/avif 2602:803:c003:200::67
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://beacon-ams3.rubiconproject.com/beacon/d/606a40a2-0a69-46cb-9863-1021de7a5f6a?oo=0&accountId=20988&siteId=513654&zoneId=3082760&sizeId=2&e=6A1E40E384DA563B233262DBD959DA65F4AAC23BB2F61E122628BBE74AFB4B952DC4B5039FFC686F5AAA79937752CF5CB8B520C6696685691D97CEC6F14526E4B86F7EFCF78E14579B145C2331B70111A1552769D52910BE9840C8F09794715290C0375E4938D1A4A2F6EA20F5D9FEBE82F5DF222211DC5CDA7C2277C8E8C8434E6FC96756E5E571CDB72F07131AAB53019676A0A6E9D501C52FDFC6BEC2D41E0A4DCF435E00C7B4F23284E4AA4490E99203DAD93E2DCF24CDA10306204D320B

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2602:803:c003:200::67 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
x-frame-options: DENY
content-type: image/avif
cache-control: private, max-age=0, no-cache
content-length: 43
x-xss-protection: 1; mode=block
expires: 01 Jan 1970 10:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 31A2 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d8cf56b4a07234b3d6b7958cf7b41b43d1adbdf141ce8ce81fa11621bfd4a586

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame BADC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartstreamtv_dbm&google_cm&google_dbm&gdpr=0
https://ads.smartstream.tv/cm/?cmsrc=dcm&gdpr=0&google_gid=CAESEHQeBuViFPkjQci_Qzg1LJ0&google_cver=1
https://cm.adsafety.net/?_cmsrc=dcm&testmidt=1&testdid=CAESEHQeBuViFPkjQci_Qzg1LJ0&idt=0&did=0&data[stv][midt]=100&data[stv][mdid]=8454f4ab16f81f8613ffb6bcc59494f6&uid=8454f4ab16f81f8613ffb6bcc5949...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=admans&ttd_tpi=1&gdpr=1&gdpr_consent=

70 B
149 B

101ms
31ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=admans&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKijpQIQ2M6oAhiK2LJvMAE&v=APEucNV133zMeCJ1J8S64L_mC42wS7jusH2aBTJZd4xFNk8eAsosgQrhshyVxCICH2cHIcJ4iRa6cfG2oC4scuq1vwI8cZifisA4v73Af1EgbOBqnUByU_Y
Protocol: H2
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:38 GMT
server: Kestrel
content-length: 70
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 08 Dec 2023 15:00:38 GMT
Last-Modified: Fri, 08 Dec 2023 15:00:38 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=admans&ttd_tpi=1&gdpr=1&gdpr_consent=
Cache-Control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
Connection: keep-alive
Expires: Mon, 28 Jul 1997 05:00:00 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame BADC 170 B
188 B 50ms
49ms Image
image/png 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKijpQIQ2M6oAhiK2LJvMAE&v=APEucNV133zMeCJ1J8S64L_mC42wS7jusH2aBTJZd4xFNk8eAsosgQrhshyVxCICH2cHIcJ4iRa6cfG2oC4scuq1vwI8cZifisA4v73Af1EgbOBqnUByU_Y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E701 0
20 B 88ms
85ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2410469703603&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E701 0
20 B 89ms
85ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2410469703603&version=m202309260101&ct=76&x=8&cor=5259701006572973000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E701 97 KB
39 KB 107ms
107ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AAzeupuEErSOeih49AkAjypLDfwCOG12xRsiCGZhQ1iuipKQKPG5_JgWX37UoAyY-yRcEoEs9SehNn1DgOUNN4j4m5XOg_tEF_XcAvuRGLY27i7yMRtMsclDQerNNbNfXFmf-59Ut9mavisJhxQOes64ePieG27za6QiRyKuazpg6u94w&dbm_d=AKAmf-BRrlr9y-cFtSvRPvKAdvfcktnUJDcyGYv03GTDD993RW0bySwy-eI18cc4Z62nziu-0YnM41Z0iGXAHRpEhPKoMgWnnLq9h2A6HKkUE6Twme2Pexpom2OR3HZNRZATqG1P6tOBtjQtC68qsesqF4-WHXVfw5_5gHNfoGc9zJRzleQl5jJTOdQlPpZK4SEB5g3omkpLMybIffWDMcRZ1syPkXkfUYkoex8Jbu23n8BPaa0A5alral_IsZ_5rw0ZWWEwSBGwhLMjtoht8oG8G9TrbZx4iWMipJc2aLoR5xIzEWGGJeBytpJMJb2lVAtbbIHgDK40Ntw1RXvwv9-txCmGs9Fieslw8_-yJvSoO4-FQu-8ofQSrVSFqrfe3rnunLa-laOFNLy1JveaaGK2hRVqJBwlxMgbMi4IpJyU2bgHUt92zYe-4lZC-x5Kq3U6pAjWrjiI2hXunjtX_ZqaTeBWPZ7aNDpTCwE7ntDfT3K3v5BKput0R0Q5gmpBhiFd6c8kyN9oqvy36vR2jxPyGAz7hAtLiBjVmsxMzWF1gFjzh0PyWGi8bdK112zCjJsFLmgTJT0OvFDxn1qbgYLWtC33NaKc5ZK8Ur7uOA-WcA0TVyAqBDjGWTxNt8SmUDafUHZvP6DjnfkPqHoViHB4m3Bq5bOR3BluBYEqngzxRWqDwW2AY8YLqBc53fpjYoVrNP7yf2hjJoqssw52NFYwFGWnojMrhFOWGCnkS-B-OM0fC4f2ErVBp8H0Gj5FOCmsGtlisv7qsbGSANA0amljxNzouncOkMglp67IBQFQkq7kE1TgaKqPEhCHOucoacxlAjH4Nd-3uyzhurtmRd1QB9t_Y6pApbeipqBO1rM2aBwqiw-an-15P0yeDe47SB6u0utJScn4uOeeg4Irfc0gDSWer6iVHCodUARtzMbws44ffAOGrwZxUXOBTdpbxR9WktQZrpZc8lbR2Xnov2-Lrpmy3kmzMv7uX6Z-xrinHjIRaPULbxKw-s8r0Ojno93kXoUPdAljxR_EuM2Li1Ci3e_hq807lkeIJIvq2khnoZjcf5d75fb99N9QUiAZQbpneFk1-l9Bq3g-fTeWWYglOOD0P7lZYP-1qm3Kd5PMEPsPpTpLX9CQa8O4-uZzTnnRwSZaPS3c5Ltqdv_O1jr4wX_-ng7BN2FfdPvMq_9njFO_eRBmPqVDBAQwArMGaKUEMURV721r2MuYYbWxRI16dUx-bmXldSN5Zgjx9WulxWzOkxaFOzjQzNFDChbkrbgJr5LZbyk4_sDNJ8axS79HIobvwi0Wpbx8344Te9vPRJ1xbzQMGc-yrYd339EDBy13ZZXgUmJKNQlVbZxC3fT2IMCE_34R-plTzt0rb2ByJxZGEIXr_wAVGmWN-5wtJzgx9_Zd9z7dwj9RRHLRYYNicvxAKCDvPGQDmLbbpXoePN4LyGORI_ldae3X9pxcocQGU3HkiwputYRbqxwAraBL1pITdAqVekukjZFE2JMnLi4Vd6-EvIQ1tScH2FkMGuB5fmEXrl51aR2PbKOTS1WLxLKKl1AAnwccxDFYIgJb6dg2nFBsnws2wuTyKzp9vc8wJtrkJGoe74kPcb5aiYxSH0T3kkzbFlg9wgAR__biGNNaw9qu4v_xLR9VoeDGRx2f61sTlfl2Sh4xwmqh-7fDh_zr2h9U_vzzlxbDXlaTBEZZPglVap9lbjCAjHVvjjb2WJb7eA8tgoEdREEOIe6weYMe-Iws1MPwPSJUH8F5LmvcdvbdRzmqUtuyovgW3i_DfFpzU1GSGvDiVt52gCBDxhKQwEUkDtDd92BVx3JMTC1_AY1TdhpFRA8wBRHUP4z0HgOVIV47L_XHY0nTRQpQjTrHT7Rkfys7BNBpjTQB4tBagyRm7UXVTDsHAgm99do_0ZnqwKEvy4t5i7zSk41cHeFBo5lU6OrZ9KJf5-uuWxC8mxh9WfwxGOVjJDqeVzR8pIAN7Ket89WOF71XLM3kGy0i6vLEApdEwdqgxC0PatMrkWMs49HXww_1qibPAWJ7Qi-hEpWCKHJ9oDrF5tykpe8yyug_6s2Xo3qMa_KItVYmMQByxW-9VUg796Y8R6h9wO7j3BL8eW8Z9x6w1G8rvPM5OQDS5WJkQNlzAywhHxNn3hzdPM8AJmhyzQoYya6oPQY9FCNLm0OSn5eSvwIKU8JVimEw2n8JuZX6wT88DeFm3Cahqr21sX6eso7d8Yq49R2prXWTY-RraP8pRU2sCfksQ5cKgg8EqBS9LRCh6w1rZF4FFxJkOlpOIrHwVo9mLWIwQZjwrw4YWCVTxNpqjh0kTmC7nlja0oDCn1V_ZChNKjlECwiaiHBoz8utTnnNXxqMg2LsQbD7A1Uh2WW3z11Vff6pWboCisdaqG8A3hBjc22VJVhm72zqVB2GnlOv6AzEgTOOXkjFARdmfEOO8fA3FF7xwNsFOvprGy1CcorxBYTLk46pPu86TanFMUSI643UgT8D6eHrjCLjPtbEcf6RkphzjJonSsPt5GQwDHWRjcf3GJNN0vPpb139fKuU4xSflsE41Mh1nozdxO_uYKs3zaEd4JXJhJ1QS_FftOyJetBWwFrRhaw3ltMVRmbrLnxD2YkGiqGUTuPqfSmpZQh5-ck1kewJcdITHYKkvbvIOqYaKv6AYmoFp9qazIBbbMowVat90uFLSjInMGTiCn5EgLzOtmn4gM7dKYPMp0Dzx8F8uhqhn-KZxVz3EpXtRXZ2Jb_QLMDvLJC0d0IRF0i68RkYyP_OqPrDpIIW3jRgDZCZY-kundDRz6WacgymYIKbR_5sB3r4-D8WH8gTEmmPwTidok0n7kXootlJwHr9OnHgxRPsCIw20lLpVNkE3tGyynzwropgP5wR_zKBpPbzgr3amCXdEvWSrNZ2ie9lUEqFYZkSOQrTRoN9KL3bxnPE8lf_HODxemC3vvRN0Kti-lLp3oEUZBMPd9LkEgXXc8g4VrsTPs4dM5grEBcfE6pE8e4soG_SFkt0SQ0KDDjjVTbWdLufcU0lhoaFnh2p_68sHqMQ2KvMIzC8V62EoDQOTw4EbrZf4-D7YXed_fQKNhy8fmUi6-sO0wgK601hXDVmeKB2yW4XJqZqXIGOQ_s4LuzSSqENs5r1kf4wnPNWYc-XvnXMiMm_Srte5nRGp1Vs-thvbcLYv2G5h3A3kf2It1uwQI-fMBQ8Y-e9vEYhXX4WJaFt6I1pErg-CRrQ2RImHvwJDAZ7HotkNRQCr_dVUBdLQVdzPP3rC5DhOuca44FFX89bKgi_7_C9KQHl_x3oMsTAW4XAJf2DxL3PoWxaZ0BhGKuSqLDcX_NWN39XV_rjlJ_MZw5HNPkc4QUKyiJ6cu4zBIiPll637K2UWaOIcW5VKwjjeFQiVLXqdUh3rsiuQTpcyf6l4TiPvtZPQo4UySqr6HC5U2UIhTG2-3Wllu-OISnXNkkmee46j9DSrOoH2g&pr=8%3A6EDA796CF1219D8B&cid=CAQSMgDICaaNg7GZtPU7WDnppyYOOuSTj4_NAe_mUtpJTWShbdU9YZaGbsao5QlRTK9C-RdgGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Fhelopal.club%2F&ds=l&xdt=1&iif=1&cor=5259701006572973000&adk=3030647&idt=203&cac=0&dtd=13

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

922d3d7dd7772ab371fad867be8d540f3fc9472235a394f65289151cee4ab1b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40372
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame E701 172 KB
60 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Origin: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 19:32:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70067
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 08 Dec 2023 19:32:51 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame E701 11 KB
4 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AAzeupuEErSOeih49AkAjypLDfwCOG12xRsiCGZhQ1iuipKQKPG5_JgWX37UoAyY-yRcEoEs9SehNn1DgOUNN4j4m5XOg_tEF_XcAvuRGLY27i7yMRtMsclDQerNNbNfXFmf-59Ut9mavisJhxQOes64ePieG27za6QiRyKuazpg6u94w&dbm_d=AKAmf-BRrlr9y-cFtSvRPvKAdvfcktnUJDcyGYv03GTDD993RW0bySwy-eI18cc4Z62nziu-0YnM41Z0iGXAHRpEhPKoMgWnnLq9h2A6HKkUE6Twme2Pexpom2OR3HZNRZATqG1P6tOBtjQtC68qsesqF4-WHXVfw5_5gHNfoGc9zJRzleQl5jJTOdQlPpZK4SEB5g3omkpLMybIffWDMcRZ1syPkXkfUYkoex8Jbu23n8BPaa0A5alral_IsZ_5rw0ZWWEwSBGwhLMjtoht8oG8G9TrbZx4iWMipJc2aLoR5xIzEWGGJeBytpJMJb2lVAtbbIHgDK40Ntw1RXvwv9-txCmGs9Fieslw8_-yJvSoO4-FQu-8ofQSrVSFqrfe3rnunLa-laOFNLy1JveaaGK2hRVqJBwlxMgbMi4IpJyU2bgHUt92zYe-4lZC-x5Kq3U6pAjWrjiI2hXunjtX_ZqaTeBWPZ7aNDpTCwE7ntDfT3K3v5BKput0R0Q5gmpBhiFd6c8kyN9oqvy36vR2jxPyGAz7hAtLiBjVmsxMzWF1gFjzh0PyWGi8bdK112zCjJsFLmgTJT0OvFDxn1qbgYLWtC33NaKc5ZK8Ur7uOA-WcA0TVyAqBDjGWTxNt8SmUDafUHZvP6DjnfkPqHoViHB4m3Bq5bOR3BluBYEqngzxRWqDwW2AY8YLqBc53fpjYoVrNP7yf2hjJoqssw52NFYwFGWnojMrhFOWGCnkS-B-OM0fC4f2ErVBp8H0Gj5FOCmsGtlisv7qsbGSANA0amljxNzouncOkMglp67IBQFQkq7kE1TgaKqPEhCHOucoacxlAjH4Nd-3uyzhurtmRd1QB9t_Y6pApbeipqBO1rM2aBwqiw-an-15P0yeDe47SB6u0utJScn4uOeeg4Irfc0gDSWer6iVHCodUARtzMbws44ffAOGrwZxUXOBTdpbxR9WktQZrpZc8lbR2Xnov2-Lrpmy3kmzMv7uX6Z-xrinHjIRaPULbxKw-s8r0Ojno93kXoUPdAljxR_EuM2Li1Ci3e_hq807lkeIJIvq2khnoZjcf5d75fb99N9QUiAZQbpneFk1-l9Bq3g-fTeWWYglOOD0P7lZYP-1qm3Kd5PMEPsPpTpLX9CQa8O4-uZzTnnRwSZaPS3c5Ltqdv_O1jr4wX_-ng7BN2FfdPvMq_9njFO_eRBmPqVDBAQwArMGaKUEMURV721r2MuYYbWxRI16dUx-bmXldSN5Zgjx9WulxWzOkxaFOzjQzNFDChbkrbgJr5LZbyk4_sDNJ8axS79HIobvwi0Wpbx8344Te9vPRJ1xbzQMGc-yrYd339EDBy13ZZXgUmJKNQlVbZxC3fT2IMCE_34R-plTzt0rb2ByJxZGEIXr_wAVGmWN-5wtJzgx9_Zd9z7dwj9RRHLRYYNicvxAKCDvPGQDmLbbpXoePN4LyGORI_ldae3X9pxcocQGU3HkiwputYRbqxwAraBL1pITdAqVekukjZFE2JMnLi4Vd6-EvIQ1tScH2FkMGuB5fmEXrl51aR2PbKOTS1WLxLKKl1AAnwccxDFYIgJb6dg2nFBsnws2wuTyKzp9vc8wJtrkJGoe74kPcb5aiYxSH0T3kkzbFlg9wgAR__biGNNaw9qu4v_xLR9VoeDGRx2f61sTlfl2Sh4xwmqh-7fDh_zr2h9U_vzzlxbDXlaTBEZZPglVap9lbjCAjHVvjjb2WJb7eA8tgoEdREEOIe6weYMe-Iws1MPwPSJUH8F5LmvcdvbdRzmqUtuyovgW3i_DfFpzU1GSGvDiVt52gCBDxhKQwEUkDtDd92BVx3JMTC1_AY1TdhpFRA8wBRHUP4z0HgOVIV47L_XHY0nTRQpQjTrHT7Rkfys7BNBpjTQB4tBagyRm7UXVTDsHAgm99do_0ZnqwKEvy4t5i7zSk41cHeFBo5lU6OrZ9KJf5-uuWxC8mxh9WfwxGOVjJDqeVzR8pIAN7Ket89WOF71XLM3kGy0i6vLEApdEwdqgxC0PatMrkWMs49HXww_1qibPAWJ7Qi-hEpWCKHJ9oDrF5tykpe8yyug_6s2Xo3qMa_KItVYmMQByxW-9VUg796Y8R6h9wO7j3BL8eW8Z9x6w1G8rvPM5OQDS5WJkQNlzAywhHxNn3hzdPM8AJmhyzQoYya6oPQY9FCNLm0OSn5eSvwIKU8JVimEw2n8JuZX6wT88DeFm3Cahqr21sX6eso7d8Yq49R2prXWTY-RraP8pRU2sCfksQ5cKgg8EqBS9LRCh6w1rZF4FFxJkOlpOIrHwVo9mLWIwQZjwrw4YWCVTxNpqjh0kTmC7nlja0oDCn1V_ZChNKjlECwiaiHBoz8utTnnNXxqMg2LsQbD7A1Uh2WW3z11Vff6pWboCisdaqG8A3hBjc22VJVhm72zqVB2GnlOv6AzEgTOOXkjFARdmfEOO8fA3FF7xwNsFOvprGy1CcorxBYTLk46pPu86TanFMUSI643UgT8D6eHrjCLjPtbEcf6RkphzjJonSsPt5GQwDHWRjcf3GJNN0vPpb139fKuU4xSflsE41Mh1nozdxO_uYKs3zaEd4JXJhJ1QS_FftOyJetBWwFrRhaw3ltMVRmbrLnxD2YkGiqGUTuPqfSmpZQh5-ck1kewJcdITHYKkvbvIOqYaKv6AYmoFp9qazIBbbMowVat90uFLSjInMGTiCn5EgLzOtmn4gM7dKYPMp0Dzx8F8uhqhn-KZxVz3EpXtRXZ2Jb_QLMDvLJC0d0IRF0i68RkYyP_OqPrDpIIW3jRgDZCZY-kundDRz6WacgymYIKbR_5sB3r4-D8WH8gTEmmPwTidok0n7kXootlJwHr9OnHgxRPsCIw20lLpVNkE3tGyynzwropgP5wR_zKBpPbzgr3amCXdEvWSrNZ2ie9lUEqFYZkSOQrTRoN9KL3bxnPE8lf_HODxemC3vvRN0Kti-lLp3oEUZBMPd9LkEgXXc8g4VrsTPs4dM5grEBcfE6pE8e4soG_SFkt0SQ0KDDjjVTbWdLufcU0lhoaFnh2p_68sHqMQ2KvMIzC8V62EoDQOTw4EbrZf4-D7YXed_fQKNhy8fmUi6-sO0wgK601hXDVmeKB2yW4XJqZqXIGOQ_s4LuzSSqENs5r1kf4wnPNWYc-XvnXMiMm_Srte5nRGp1Vs-thvbcLYv2G5h3A3kf2It1uwQI-fMBQ8Y-e9vEYhXX4WJaFt6I1pErg-CRrQ2RImHvwJDAZ7HotkNRQCr_dVUBdLQVdzPP3rC5DhOuca44FFX89bKgi_7_C9KQHl_x3oMsTAW4XAJf2DxL3PoWxaZ0BhGKuSqLDcX_NWN39XV_rjlJ_MZw5HNPkc4QUKyiJ6cu4zBIiPll637K2UWaOIcW5VKwjjeFQiVLXqdUh3rsiuQTpcyf6l4TiPvtZPQo4UySqr6HC5U2UIhTG2-3Wllu-OISnXNkkmee46j9DSrOoH2g&pr=8%3A6EDA796CF1219D8B&cid=CAQSMgDICaaNg7GZtPU7WDnppyYOOuSTj4_NAe_mUtpJTWShbdU9YZaGbsao5QlRTK9C-RdgGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Fhelopal.club%2F&ds=l&xdt=1&iif=1&cor=5259701006572973000&adk=3030647&idt=203&cac=0&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 14:00:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3581
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 14:00:57 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame E701 31 KB
12 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6cbe31747c16c069d861a8ed01b15186eaee8c381f74ca1712087811c39f4d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 19:10:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71379
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11943
x-xss-protection: 0
server: cafe
etag: 4141415479739543000
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 19:10:59 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame E701 41 KB
14 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 593730
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame F075 281 B
555 B 79ms
23ms Document
text/html 2.19.217.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
Requested by: Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.217.60 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-60.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Dec 2023 15:00:39 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 0760 38 KB
13 KB 54ms
53ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 280154
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 09:11:25 GMT
expires: Wed, 04 Dec 2024 09:11:25 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame F075 46 KB
13 KB 26ms
25ms Script
text/html 2.19.217.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.217.60 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-60.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: b35795583c515533313898d0e14334b4434610737c7acb1ae0846476559a2114

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:39 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Dec 2023 04:50:38 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=49790
Connection: keep-alive
Content-Length: 13232
Expires: Sat, 09 Dec 2023 04:50:29 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame E701 202 KB
64 KB 114ms
114ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Dec 2023 15:00:39 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12399363937564646419/ Frame 4B21 10 KB
2 KB 63ms
63ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12399363937564646419/index.html?e=69&leftOffset=0&topOffset=0&c=ZWTgJur5d9&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47e62e32edebec69ad2df63aae2c93ae75c9cf7c2634afe6b8b91f197890ae25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2431
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:39 GMT
expires: Sat, 07 Dec 2024 15:00:39 GMT
last-modified: Tue, 24 Oct 2023 09:27:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E701 0
0 187ms
84ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvwosii--9lOVguqcJE_KmdhEmeMiUwrZA_nppwOQSmX6n-pczs0IKj0aWDiRgVk200c00ORjb32yvtsCaqgupBwB0g-w8tufJKBv0QcgY0SR_p5zBw7hDgVx_Jo8DIqwgZPqf51MhqB63gzcylgZX-KHQElkSW88f0xwEA6Cnwt4vAukvGWYNxg6ZuxQBl9gCTWaSJFSTV5df9Xnmje4tuSscqe_kj2lKQMOgfB5y0dwgs-NPkF6f4SCcFyxheu_Tkli92QVpnd-i7ynZpOHqGtxfW39KL5LR6d_XU6Mt7QDdD70zDMfXY5PIXufVtmEEXprNg8QiDaRVyRJhTOxlebVQCovAMjWZIhBP0aMWzQU2VKWhsadmxHzvvINehBxp5Q2mzUXZa7kQ97nMPgdmbAPkaqXiF1CoViujeADWrtJCVwU_4YNboTLobmBwRDB-EzyHNPpiht-Su4NbU8Za4PsdQh1eIZOweafg9K2nqB3jI98xzw45f3EQrIFPTiiLHEn0WSf5gYqpkrWk8Mt2hisM1q_gS_bxUdwTFAKiRoYVrRrKxPNWmZ_7srp9N6E9RUJT_ezuP1KKHTe-g6xVTwQn1qXV9BWwVvAPohi_2OvGdVA864X8gJGvBwOCH6FdoXE8RqM4Wqndn7LPvKRVP0g3Kr5Vc21KpviBdeqFuC2gcuCADCzk_vcpbcFourAxvbcL_B7FCTjZCSsBcyfE1irmfxu8kbIgv-exWt51j44YBGVxdZ5V41GeiHvbkDJzcee_tIHS91ag01REGDngMcivYchiulP6tWSsG2kpsOZ8qws3dovpZjrvtpogqa4cbrEZ2u9e_m4cwpIVSU9aKQ6hLTAkYnMLsQuTHTdT7GD_FMJNLalsOcHgwPkia_KPwqsLix23Zulcb4vB0v_bXk9iWJRkR9fkhCFnXMUQEeEnfRTXjh1lj0o-i-4L3LtGFAcM5Nk765o66Sz3N9ITyN-ee18dMQOa1yKkRdd4j34g6o9T8mMJzHbFqrkc-7iuvoC8CnUf12nLP2pu-cKRrxPyRwfs6fWdZGb4D2765jKNdwHoFfknhHe2a3L2sb_nsbZyygO5AbeEEkYA1UbtTk92aqQh4j4ZqRRUpWCn41Zb-NwFDD2hc7mYPmlsx9bswfwIB32KGXo3ekdgzrw5A0R51miTIZ6kY9ve8zxsd-KBkByYb-4nskTHlkVCCTIQOxXmZXb87nNXMjh_bzmlYMy1YFKc7RawM_TO1U0sUKWd9Vud3AbBM2TcAmBCJ7sH-OrnOzVM-r1Jw4rFjQqoM4EQywmo0cPcHl3jmDqS9yg&sai=AMfl-YRH0-3ZyMokRY19SoW15GU6Jm8LhlVkAHB80cXCNt5gvFsGY28Z7o-zq3HSVTWrir4TG0WpWvNvrT8tO4YBMY7_0YdK8BlkpXHvfaBIbivw_MNGAqDvHUmHhL4V4lc4PumhYpuJJ-XHfgzA17tInxxm-SdIS9DU85jCAeXHxs0dLszcu8e57vnFkqMEh9KqGcYrBW__I6zpOAdZLxculCkCJ8EZBKI9jG4FPnezi4SuMP33mlw8ZiyqGoELtkUyuZeRpO4HPP7-0hJVwABW&sig=Cg0ArKJSzIdyEziBOJj6EAE&uach_m=%5BUACH%5D&pr=8:6EDA796CF1219D8B&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=103&cbvp=1&cstd=97&cisv=r20231206.45812&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame F075 7 B
380 B 34ms
11ms XHR
application/json 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 0760 39 KB
15 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 14:57:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 204
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 14:57:15 GMT

GET
H3 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 4B21 57 KB
23 KB 94ms
93ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12399363937564646419/index.html?e=69&leftOffset=0&topOffset=0&c=ZWTgJur5d9&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12399363937564646419/index.html?e=69&leftOffset=0&topOffset=0&c=ZWTgJur5d9&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 08 Dec 2023 15:00:39 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 4B21 120 KB
41 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12399363937564646419/index.html?e=69&leftOffset=0&topOffset=0&c=ZWTgJur5d9&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12399363937564646419/index.html?e=69&leftOffset=0&topOffset=0&c=ZWTgJur5d9&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 12:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9430
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 12:23:29 GMT

GET
H2 200 polite.js Show response
joyn.kr-adstudios.com/img/banner-js/ Frame 4B21 86 KB
87 KB 106ms
17ms Script
application/javascript 2600:9000:2447:9600:7:dde5:8880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://joyn.kr-adstudios.com/img/banner-js/polite.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12399363937564646419/index.html?e=69&leftOffset=0&topOffset=0&c=ZWTgJur5d9&t=1&renderingType=2&ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2447:9600:7:dde5:8880:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

f56cf558e4526ba5116061cca5bdffdb159449245b4d202251e29ad1b7ffbfde

Security Headers

Name	Value
Content-Security-Policy	default-src https: gap: ws: 'unsafe-eval' 'unsafe-inline'; img-src * 'self' data: https:; font-src 'self' data:
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 07:40:12 GMT
via: 1.1 87e83cc6e8f384d40eab78133e901302.cloudfront.net (CloudFront)
x-content-type-options: nosniff
content-security-policy: default-src https: gap: ws: 'unsafe-eval' 'unsafe-inline'; img-src * 'self' data: https:; font-src 'self' data:
strict-transport-security: max-age=63072000; includeSubdomains;
age: 26453
x-amz-cf-pop: AMS58-P5
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 88197
x-xss-protection: 1; mode=block
last-modified: Fri, 13 Oct 2023 12:00:00 GMT
server: AmazonS3
etag: "be0097968a4b98b9427d98c7c07f9716"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
x-amz-cf-id: Kop0f4A3j2n9cb-NfPpkpgGpeaUCSnz_IBo_sVJ7GjAOG2cOh0GRzg==

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6DC4 42 B
64 B 95ms
95ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvWevcs-T7JFUdz97xFHNMUwU1bWQaP0m1AiiRmLwmvaOrczujjEyIapWaYJoQLZdZ3AanYyO7HdKxFHS0gOIkPIBuSe5S-WY6fF7KFQL1nPSuPN0MRMU59KF8DCnh8GmS-vPNnycYH5CR9&sai=AMfl-YQMcKOW3Lhb2SM5yOiQ9SCciqbU2xPXfpb1FmlSgu-xEjkcCUMPu200JyLC12adYFmVl5tn0Sy_1g4pVXzr8M7UEIkk3JDB_W90t1mHaLjxScX91SWXTvGW7gfcm2kYfolemiHCKBI&sig=Cg0ArKJSzNnuoyKcX1QnEAE&cid=CAQSPADICaaNmKLut3g6PTuuLgk84Gnwx6PJwm3XI_IDoyod3biOlj8IHQ4nnvEk1XvSdmdT3yjbnw4JDwMZhxgB&id=lidar2&mcvt=1001&p=99,640,149,960&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231206&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3810924492&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702047637872&rpt=255&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0760 0
20 B 90ms
90ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BEGwtli9zZbvaMobmx_AP-qmN6AIAAAAAOAHgBAI&bg=!8fKl8r3NAAY3kmNgF5I7ADQBe5WfOAHX5iBdLCVVydxViJWR4etpxfu64Q16b4o9-Q-rkITwenX3yX31Ri0738IJAESsAgAAADJSAAAAAWgBB5kDi698r-HuE41gOVc5dNRQ9XCTAkLE3r-MeuHvScNNu7cQyBINBYhWiA6kQvocmn4hJIv5Q_A2ln_jYq704YZCzSffeU8lAfUDkb1fsHHL0yT1q9EGGCCfdbBGK5TloTRlcxFFhDCpbsuZjsl_cJIdhlF5iUGsQi07O5741GjtAh48eurARU5uVA2irmu92C9nc4pUubTlNM4R77AEw2L7AhWFXcDJxBb3G37uIMJeCl09-cXh2ChQLHlOjn5H8GAg_ZTKoaXytKRJEXlMHgb6LJq8qgpt4i34xZGu8bc1yPsRe4QWiJ1kRwf31m3K1zssCPth2jFpZFAFbCg8ZXFF0jr3nKt8rG4Ju8QlasV58SUMBihEgPoPq7CFDkQWpzH2Gm-komjD7GmKZMcy9jlXlZol11UWUMeWxfH_ceQWYXmoQ58iYQl9YZa3uOwpXW86gfZ3jmI0cRevcGnBWP4ORtxqtkMgr0yNSdzQZC89OvGaD9r6z1EXpb6rTp4CeCTtv26vc0hnBLts3nlY4vbZsIC-9GQnHlGUyn_X7OMyzMxyMzgFkQjjuzrAaTJHhmZCXSi9328eqNlrlcTCZEmkApdJz61Mh_nNdY3hWAEL_7FGvrxNulAMkSgDnZDopM7LWu-OlzDyT1gOBGyR-luVhs8XYdvggCLJ185okJJOEe1t3YyX5FR3zi2ID2jekSpVXbcqw9gzP21KDTpB7d_57cV6XXaHek4Jd1I0FCpjnTi_yKWlKCz0ulHtZR9ctJcnJSQm7C_JOuHHaNoQnsxc0YH8pG9nmoxK53ypW9kKYFeLNmDI1ObYrLmCWBtmfXHMEeEh7edUetQQEA77GmVocAeIMxf6ErMTfJUluJlmcBvF6BdgtGh4nxKTdZTd3KJWg9jhQQ4IaYwK_MuJk3q7aSEoMkcAiyOChQ36njDcyZ6Op4GcXnYtzqxc8T534-ze4zAvXpGDEu0ruSCpw31SwvcLP1lG71aX0rJowgZRXMeFagQI6eEboLChapiSETuVcgM3w2kXz1U5yW3cVQGYw2s01WPkCwRsPOhA_tomIm4tlxoD5aFUPTqo5M3enzdPidkPu7d8roDmwy10C23C66fEID9G7uwZdpJbDbGR2gWqj7D21WrXwrh6LD6jaaoUlFfastUjrhNTczYPkCY4sKM-o4IMuCae9srHuPNyIt1GDE0alhTa207mwGI

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2276 6 KB
3 KB 54ms
53ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202312040101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:37 GMT
expires: Sat, 07 Dec 2024 15:00:37 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E701 0
0 77ms
76ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvwosii--9lOVguqcJE_KmdhEmeMiUwrZA_nppwOQSmX6n-pczs0IKj0aWDiRgVk200c00ORjb32yvtsCaqgupBwB0g-w8tufJKBv0QcgY0SR_p5zBw7hDgVx_Jo8DIqwgZPqf51MhqB63gzcylgZX-KHQElkSW88f0xwEA6Cnwt4vAukvGWYNxg6ZuxQBl9gCTWaSJFSTV5df9Xnmje4tuSscqe_kj2lKQMOgfB5y0dwgs-NPkF6f4SCcFyxheu_Tkli92QVpnd-i7ynZpOHqGtxfW39KL5LR6d_XU6Mt7QDdD70zDMfXY5PIXufVtmEEXprNg8QiDaRVyRJhTOxlebVQCovAMjWZIhBP0aMWzQU2VKWhsadmxHzvvINehBxp5Q2mzUXZa7kQ97nMPgdmbAPkaqXiF1CoViujeADWrtJCVwU_4YNboTLobmBwRDB-EzyHNPpiht-Su4NbU8Za4PsdQh1eIZOweafg9K2nqB3jI98xzw45f3EQrIFPTiiLHEn0WSf5gYqpkrWk8Mt2hisM1q_gS_bxUdwTFAKiRoYVrRrKxPNWmZ_7srp9N6E9RUJT_ezuP1KKHTe-g6xVTwQn1qXV9BWwVvAPohi_2OvGdVA864X8gJGvBwOCH6FdoXE8RqM4Wqndn7LPvKRVP0g3Kr5Vc21KpviBdeqFuC2gcuCADCzk_vcpbcFourAxvbcL_B7FCTjZCSsBcyfE1irmfxu8kbIgv-exWt51j44YBGVxdZ5V41GeiHvbkDJzcee_tIHS91ag01REGDngMcivYchiulP6tWSsG2kpsOZ8qws3dovpZjrvtpogqa4cbrEZ2u9e_m4cwpIVSU9aKQ6hLTAkYnMLsQuTHTdT7GD_FMJNLalsOcHgwPkia_KPwqsLix23Zulcb4vB0v_bXk9iWJRkR9fkhCFnXMUQEeEnfRTXjh1lj0o-i-4L3LtGFAcM5Nk765o66Sz3N9ITyN-ee18dMQOa1yKkRdd4j34g6o9T8mMJzHbFqrkc-7iuvoC8CnUf12nLP2pu-cKRrxPyRwfs6fWdZGb4D2765jKNdwHoFfknhHe2a3L2sb_nsbZyygO5AbeEEkYA1UbtTk92aqQh4j4ZqRRUpWCn41Zb-NwFDD2hc7mYPmlsx9bswfwIB32KGXo3ekdgzrw5A0R51miTIZ6kY9ve8zxsd-KBkByYb-4nskTHlkVCCTIQOxXmZXb87nNXMjh_bzmlYMy1YFKc7RawM_TO1U0sUKWd9Vud3AbBM2TcAmBCJ7sH-OrnOzVM-r1Jw4rFjQqoM4EQywmo0cPcHl3jmDqS9yg&sai=AMfl-YRH0-3ZyMokRY19SoW15GU6Jm8LhlVkAHB80cXCNt5gvFsGY28Z7o-zq3HSVTWrir4TG0WpWvNvrT8tO4YBMY7_0YdK8BlkpXHvfaBIbivw_MNGAqDvHUmHhL4V4lc4PumhYpuJJ-XHfgzA17tInxxm-SdIS9DU85jCAeXHxs0dLszcu8e57vnFkqMEh9KqGcYrBW__I6zpOAdZLxculCkCJ8EZBKI9jG4FPnezi4SuMP33mlw8ZiyqGoELtkUyuZeRpO4HPP7-0hJVwABW&sig=Cg0ArKJSzIdyEziBOJj6EAE&uach_m=%5BUACH%5D&pr=8:6EDA796CF1219D8B&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=304&vt=11&dtpt=201&dett=3&cstd=97&cisv=r20231206.45812&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 31A2 0
0 205ms
96ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst4sMq2QJ9A8ZoYTDa6bsgiYemScOT5cc6nqEVAvsgAeJdO9Umyyx3b_Guee5AfDQo5ZNuK4qxClhMCwt53Fcdye6awNyAURhr3n0q9VLsY81gZxt_FJqY7HPijZfSYyccAKxvf_yAX0QIhgLSNsrxNU9jTgsAiVFF7i-R8b0uwB8eaHwgKwSiUb1TOmUy6bcou5JYm1Ar9VCj557gKq-fuQ0zxKPmHOQj751MY1efEequUKLYhD-iWxKwD_9uS5HOf_KXouvbl4k3V5-0wHxqU056SMUVdEJSkT3uBKfeV3oBIGtBC9q0hnlv0CGc0UUdX_CGYNuuIDIOf7lt_jtgilVsmAvNpbNEdKHUuQAq32bbT64oDN-iz93PMHEbodZqSoy7KPP9t63TzocMYHw&sai=AMfl-YRU81FuUvoviTOLLpkdEIUN-0baY00QXOB9Vg_XcszUmAGVk4kOA1vTPpX5_2fRCzS41rMnr5iw8Ji8o0-MYHA0w2sT899tsnO6kE2ywcBBybRQ18RIPdvYTwIQkanSMX_sq3isS-Yg9w&sig=Cg0ArKJSzOrtSp40BXuDEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 08 Dec 2023 15:00:39 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 4B21 8 KB
6 KB 100ms
99ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

29cdbdf522c538e3de84c0bcb316a4ebd32eca77082d1582506537a338cb799a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5924
x-xss-protection: 0

GET
H/1.1 200
OK logo-joyn.svg Show response
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/ Frame 4B21 864 B
1 KB 160ms
49ms Fetch
image/svg+xml 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/logo-joyn.svg
Requested by: Host: joyn.kr-adstudios.com
URL: https://joyn.kr-adstudios.com/img/banner-js/polite.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 8695956c55e8679652a5e34279fbcf353078c3883143582a847b8a26a50a3774

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Mon, 04 May 2020 20:14:51 GMT
Server: AmazonS3
x-amz-request-id: PBB75HYY2N9DTGVA
ETag: "4cfbd49bbe5134d80e544db8176b5503"
Access-Control-Max-Age: 0
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods: GET, HEAD
Access-Control-Allow-Origin: *
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 864
x-amz-id-2: 7+ewMuFQWlx6taKt+d514jHb6pOa+Go0IabqyDQJCnNktOHqtkyYjKDEOlirMEnQ8GOTaL+y5KhWJRRjdq0VAQ==

GET
H/1.1 200
OK baseanimation_su.js Show response
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/ Frame 4B21 31 KB
31 KB 159ms
47ms Script
application/javascript 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/baseanimation_su.js
Requested by: Host: joyn.kr-adstudios.com
URL: https://joyn.kr-adstudios.com/img/banner-js/polite.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7017dd89c36e7c0b58a09fd549d82ab2cb94222822c3fea417b5f9b8a87390e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Fri, 13 Oct 2023 12:02:33 GMT
Server: AmazonS3
x-amz-request-id: PBB7D8NYCJ3627JH
ETag: "a4381331c24e7a56145aabbdbaa4402e"
x-amz-server-side-encryption: AES256
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 31370
x-amz-id-2: y5eEX57tKWAjWGr56UKpsavmlWereA9n6KnNQm1VqSXtRBKYlYU4+oR8orgcr5/+FhupVxF7BAiPh3vs3N8APA==

GET
H/1.1 200
OK teaser3_@1.5x.jpg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyp5xwz7/728x90/ Frame 4B21 6 KB
7 KB 168ms
50ms Image
image/jpeg 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyp5xwz7/728x90/teaser3_@1.5x.jpg?v=202312816039200
Requested by: Host: helopal.club
URL: https://helopal.club/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: d9bb81ff9677b3198471a835c4b4bcdbac8bf83690aed07305944baf02f240f5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Wed, 16 Dec 2020 17:37:12 GMT
Server: AmazonS3
x-amz-request-id: PBB34H0SHKMRVR0N
ETag: "0d2d67b61805fccf0215898aaf792881"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 6512
x-amz-id-2: zpG7D9FqrvvnDOiadaSblMIFiDll+VZMpLf2tsB7ZCdk/JhBG2NkRkCK7im7RHDTQ5w7q71XAFhOgDCgVnGwqg==

GET
H/1.1 200
OK teaser3_@1.5x.jpg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyoor9au/728x90/ Frame 4B21 14 KB
14 KB 158ms
44ms Image
image/jpeg 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyoor9au/728x90/teaser3_@1.5x.jpg?v=202312816039200
Requested by: Host: helopal.club
URL: https://helopal.club/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: c02562a57e9268300e4d34ed8a8a37c6215f08ebfd3c24afc8a31bf33293a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Mon, 13 Feb 2023 16:29:34 GMT
Server: AmazonS3
x-amz-request-id: PBB2E7E3TP08XJMC
ETag: "7056b091b9f5aa3a3f31e21bd47544a6"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 14375
x-amz-id-2: nO7zpGl5OC0OyNWW8qgBuxylFH0OfD6yJo7axBzS+a1RAvOFrq7vzPR8SI7UGRYqResXdFSThARnJxsJtcj+Vw==

GET
H/1.1 200
OK teaser3_@1.5x.jpg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p1bp931e2rp/728x90/ Frame 4B21 16 KB
16 KB 154ms
45ms Image
image/jpeg 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p1bp931e2rp/728x90/teaser3_@1.5x.jpg?v=202312816039200
Requested by: Host: helopal.club
URL: https://helopal.club/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: faa576f54633087872ee4c26a4ad87b2f864f5285b2cb21cb0ed3132fed1c557

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Mon, 13 Feb 2023 16:41:00 GMT
Server: AmazonS3
x-amz-request-id: PBB95FYK3ZCS402T
ETag: "ffd20f46a6c01f6bfef1c8ced1180ae3"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 16260
x-amz-id-2: /JGF+XUSDBdQK+y5njaD4U1ZXMmhgiT8HkbmJOMwRNd4YLiNsWzZv7oFtiqla6/T26Minl1yLS5o7zXmB/f42w==

GET
H/1.1 200
OK logo.png
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyp5xwz7/ Frame 4B21 11 KB
12 KB 156ms
48ms Image
image/png 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyp5xwz7/logo.png
Requested by: Host: helopal.club
URL: https://helopal.club/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 4d49809a3e7379f46dd69f308337cd8c570c31e539c33e3183ace04b7935f802

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Thu, 30 Jun 2022 09:22:42 GMT
Server: AmazonS3
x-amz-request-id: PBBATZ2CG55C9TWH
ETag: "b65585e8a39ffa47975c42b9cddaf2e9"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 11723
x-amz-id-2: rVGRPiE0ITdjgwTUPv4urnZwqvkVFheYbPx1Iya/hb943M7qys3lItgwjbtiC0sXmVEQT5xryjsK5UmgJ4G1aQ==

GET
H/1.1 200
OK logo.png
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyoor9au/ Frame 4B21 4 KB
5 KB 37ms
37ms Image
image/png 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyoor9au/logo.png
Requested by: Host: helopal.club
URL: https://helopal.club/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 56fedd576ff4a20677e36cf4a3464674224723d71f39af53d846a9a261446e70

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Tue, 04 Jul 2023 13:25:20 GMT
Server: AmazonS3
x-amz-request-id: PBB6RFRYFAG779X1
ETag: "29df3ed88ee60bf8440fd4367a874fec"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 4464
x-amz-id-2: OM9SReGqQqVrou+IXglhQnw4HWzITUW4vv+WMH3Xvws6l++yg51xR0+eo/OeGWD7MfKvqnvfTLescJnEzVyyhQ==

GET
H/1.1 200
OK logo.png
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p1bp931e2rp/ Frame 4B21 6 KB
6 KB 38ms
37ms Image
image/png 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p1bp931e2rp/logo.png
Requested by: Host: helopal.club
URL: https://helopal.club/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7b006c26b599c26431ec98f5891b32af7dd70a9a19397e5147a9ca534d2132db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Tue, 04 Jul 2023 14:07:39 GMT
Server: AmazonS3
x-amz-request-id: PBB38VT1YBQYT14X
ETag: "fffdd48e920b60c5e7c051438fbbf195"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 5804
x-amz-id-2: uaa96i6mSvHXWswPLXDlhrQnAImlX+A8n6GK5BS51FgC4RtcOD6IdANIBk250+3zvXkXd+ARqQbUfIRLu+K+rQ==

GET
H/1.1 200
OK sat1-gold-medLib.svg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/ Frame 4B21 1 KB
1 KB 39ms
39ms Image
image/svg+xml 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/sat1-gold-medLib.svg
Requested by: Host: helopal.club
URL: https://helopal.club/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 088a736ef08892e4bd88c860153761272be22358fa2e3f82f92a9e6ffacdbb82

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Wed, 16 Dec 2020 09:18:30 GMT
Server: AmazonS3
x-amz-request-id: PBB0PPBCXF090VMF
ETag: "b01e1fb8641e38c14d25a48df24813c3"
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1145
x-amz-id-2: 1qlG4E4XJfD+AjwHYwYd/gIORJb8YSPEBzH440jh2nT5WdhN1LqYAcAwUbHI6jKMw8RcizMNCgQ9dYVEf8si/A==

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 2276 24 KB
6 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:25:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 318925
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 03 Dec 2024 22:25:14 GMT

GET
H3 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame 2276 26 KB
10 KB 21ms
21ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f85637bbf5c0ee6a01fa5afb711af0e3d873ab20f0cbeaeb9105998530822c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3520
x-jsd-version: 1.16.0
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230067-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"6721-FSYTlyriJmmnEqYsq5KQLDRsrFg"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XPpQADMGjR5btHtfvv3KuWxS8xQSopjJPESu76WYQ%2F9y4Rmz3cbTTI30j9gXgcCWLO2gCvLO%2FGZwcfHVBAfQQaLtRpyNIx2GCfuYsqqwHZQ8NoR7EoDw16JQKEpbGFtnJCaVh2b60dHX7ML1CbE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8325e1118e2f1c19-FRA

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2276 202 KB
64 KB 108ms
107ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Dec 2023 15:00:39 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2276 0
0 92ms
92ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsudm7ffq_P3KnO7C7scqdHT9CBocD6f2y0YHv3cDiL97H5fWeSwnz-4JPMVOM--4zvGySDxih4SsZy1qhpo4hy4iJ1UNGrCCXotB58M1JTJFKtAZc0StYrctii26eYvziFl3Sq5jo7nUfpWEIlXkUAUs8Oc-w6Bp1jmbqfaMZAjYA-fyKEEumY-NMUNcO7hQLso3XdUT_QUHE_1mHiKGcozvSUpmQMSLEugTjdTRH7JjJVTutRjZt78xIy2JbZRZPOhf_TVRhFdQavNgAWEXNNUkfnpXP03GEIp83upbLVbslNBxmGimBzYiEQPwmufwJbx97dfOoXBl0e3Rn3LVLilTuyDIMl0cQ4sRw81Ot1XNsS4QeR6sdlbHswry7kKxpn9yf5wihA9nZZXGAy7Fuo&sai=AMfl-YQtnOJbF0SGC1kuP0TnggcHiSf3GirbaEktjXxXHApg8PN1zxsGDVwfPGXlBOKklFr5NQOHN0CVqKeUyxAaikIAed0hNDr6norP3zDlfUKkoE5SBR7EOQNg-nu5BIDgHruwow1bMdj7&sig=Cg0ArKJSzIi4YCsPo1e5EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E499 281 B
124 B 95ms
94ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKijpQIQ2M6oAhi8pLJvMAE&v=APEucNW9PCBZMUTvddgR4Sb6SBWsRtEIYXuBgg7-YQ-X4naK00dAKDA3AyiPMgBnlf5PqtIP6p4CDjuVljU42uC4sILzs-GuRYDpGDugUtx4g4om_vaBJQc

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a0f95dcad4811c2b85289326687f5e63764a1a24b5f8bd2d4ad59da3858f7992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 104
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 424E 89 KB
31 KB 134ms
134ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 08 Dec 2023 15:00:39 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 424E 42 B
63 B 86ms
85ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DpMDPnvKueupRzegQU3a4l_2C7epyVzvKNxdcXbIZu9qeV4sTDFh_mT2szHj6xazxOLfI3zfLSKp9k4FSA1X2sskezjIJdM4RnrxNhDZOY5_jL8dI

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 13df2871-60cc-4401-b93a-dea0c5af6203
beacon-ams3.rubiconproject.com/beacon/d/ Frame 424E 43 B
75 B 16ms
15ms Image
image/avif 2602:803:c003:200::67
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://beacon-ams3.rubiconproject.com/beacon/d/13df2871-60cc-4401-b93a-dea0c5af6203?oo=0&accountId=25230&siteId=477094&zoneId=2872706&sizeId=9&e=6A1E40E384DA563BF76AC9C6446F54A310BAFE0A4E74280A75A8976474DA85B111CF860D63D2BE851CC94E5509BE018E5ABF4BC26238BE184C65F1215C9A8390058B5F43B7326BE470BBB3687CA0197E0E493E48E3522B640A90B3FA1D69AF5A5FF076962D249C94D642AFE9987AB55A74BF4DFFA74F2F04FBA9AECADB7E918D4E6FC96756E5E5713E0254ECB779732DE7A684F189093401B76A24C7DC1F636BA92428B15313409E3FF0EC436224266551DAB9DC3F498630CDA10306204D320B

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2602:803:c003:200::67 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:38 GMT
x-content-type-options: nosniff
x-frame-options: DENY
content-type: image/avif
cache-control: private, max-age=0, no-cache
content-length: 43
x-xss-protection: 1; mode=block
expires: 01 Jan 1970 10:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 4B21 17 KB
6 KB 91ms
91ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 15:00:39 GMT

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame E499
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartstreamtv_dbm&google_cm&google_dbm&gdpr=0
https://ads.smartstream.tv/cm/?cmsrc=dcm&gdpr=0&google_gid=CAESEBO9UtkU74Sj4Er9iL7laRg&google_cver=1
https://cm.adsafety.net/?_cmsrc=dcm&testmidt=1&testdid=CAESEBO9UtkU74Sj4Er9iL7laRg&idt=0&did=0&data[stv][midt]=100&data[stv][mdid]=8454f4ab16f81f8613ffb6bcc59494f6&uid=8454f4ab16f81f8613ffb6bcc5949...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=admans&ttd_tpi=1&gdpr=1&gdpr_consent=

70 B
148 B

31ms
31ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=admans&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKijpQIQ2M6oAhi8pLJvMAE&v=APEucNW9PCBZMUTvddgR4Sb6SBWsRtEIYXuBgg7-YQ-X4naK00dAKDA3AyiPMgBnlf5PqtIP6p4CDjuVljU42uC4sILzs-GuRYDpGDugUtx4g4om_vaBJQc
Protocol: H2
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
server: Kestrel
content-length: 70
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Fri, 08 Dec 2023 15:00:39 GMT
Last-Modified: Fri, 08 Dec 2023 15:00:39 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=admans&ttd_tpi=1&gdpr=1&gdpr_consent=
Cache-Control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
Connection: keep-alive
Expires: Mon, 28 Jul 1997 05:00:00 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame E499 170 B
188 B 47ms
47ms Image
image/png 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKijpQIQ2M6oAhi8pLJvMAE&v=APEucNW9PCBZMUTvddgR4Sb6SBWsRtEIYXuBgg7-YQ-X4naK00dAKDA3AyiPMgBnlf5PqtIP6p4CDjuVljU42uC4sILzs-GuRYDpGDugUtx4g4om_vaBJQc

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 2276 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: adb7ce488750e49ae1913e28b9db87927cc155c393b42f0434826811905c4fd0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 59D5 39 KB
15 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 14:57:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 204
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 14:57:15 GMT

GET
H/1.1 200
OK teaser3_@1.5x.jpg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyp5xwz7/728x90/ Frame 4B21 6 KB
7 KB 39ms
39ms Image
image/jpeg 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyp5xwz7/728x90/teaser3_@1.5x.jpg?v=202312816039200
Requested by: Host: joyn-creative-hosting.s3-eu-west-1.amazonaws.com
URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/baseanimation_su.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: d9bb81ff9677b3198471a835c4b4bcdbac8bf83690aed07305944baf02f240f5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Wed, 16 Dec 2020 17:37:12 GMT
Server: AmazonS3
x-amz-request-id: PBB0ZPXT5QSSRK3W
ETag: "0d2d67b61805fccf0215898aaf792881"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 6512
x-amz-id-2: +Ds0sDXiDXfIPy0eqzEkwt9Tx1PpsaVwCR5Cfkf0EPorO9adnue77T3zQDbHjjgFaB+v8AX3ZS8fX4c+HHj70g==

GET
H/1.1 200
OK teaser3_@1.5x.jpg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyoor9au/728x90/ Frame 4B21 14 KB
14 KB 38ms
37ms Image
image/jpeg 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyoor9au/728x90/teaser3_@1.5x.jpg?v=202312816039200
Requested by: Host: joyn-creative-hosting.s3-eu-west-1.amazonaws.com
URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/baseanimation_su.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: c02562a57e9268300e4d34ed8a8a37c6215f08ebfd3c24afc8a31bf33293a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Mon, 13 Feb 2023 16:29:34 GMT
Server: AmazonS3
x-amz-request-id: PBBCP1ZKNMWPRHKY
ETag: "7056b091b9f5aa3a3f31e21bd47544a6"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 14375
x-amz-id-2: 7VXItnUD//dqD7IqQHYPoxGTMyrmO07Hz0jANzdJ69QwQT6iZuDQAP81EFJm011PiRq40FnKRDUAIN17Mz0/mA==

GET
H/1.1 200
OK teaser3_@1.5x.jpg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p1bp931e2rp/728x90/ Frame 4B21 16 KB
16 KB 36ms
36ms Image
image/jpeg 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p1bp931e2rp/728x90/teaser3_@1.5x.jpg?v=202312816039200
Requested by: Host: joyn-creative-hosting.s3-eu-west-1.amazonaws.com
URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/baseanimation_su.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: faa576f54633087872ee4c26a4ad87b2f864f5285b2cb21cb0ed3132fed1c557

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Mon, 13 Feb 2023 16:41:00 GMT
Server: AmazonS3
x-amz-request-id: PBB20R9DZCHE72WP
ETag: "ffd20f46a6c01f6bfef1c8ced1180ae3"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 16260
x-amz-id-2: eQjz6FfW4rEEfwJk6784be+IoQJQCG8dXYi0WYM0vbVPhGA3pypeCz2gGFbVd5wD1Nr3d7NfJzmIkDVo24zacQ==

GET
DATA 200
OK truncated
/ Frame 4B21 18 KB
18 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44718d713af08035d3f9d246d249df63ed5d433a1d8571429241de984c0c4dd7

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 4B21 17 KB
17 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77f331acc0b5e3b63fcd3f31e9d334628691e1314b6fb0154b4ca5535828030a

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 424E 0
20 B 86ms
86ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1583465704816&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 424E 0
20 B 86ms
86ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1583465704816&version=m202309260101&ct=76&x=8&cor=13541817837438583000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 424E 97 KB
39 KB 102ms
102ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DKSRi3YrVm9W2uwHig7CRfliRY4PDJ0cteNa1Z-1VbVNSy9Nkzq3FW-O0F584mZEITJyOAufNyhaauys_7oMrRrt2GRbf1Vkg0n5aR1fMBPlzRChfol6NaYtIpc0Gyz5ILOrUw6ud0xZaH0RObvPmV8IrZogo2HWwXBSSj5VpBpQb8_iw&dbm_d=AKAmf-CAmLDqXj40pBOWMTmrMNaazA8-PeMvJHS341wldaiEmSapc5NH-mC3FDTXAB5DE29ze9j0HWebOINgL04uogGHgKzsSROe58DbZGSCG3bRyDhKm9AKCa5xM0LQSGvXfzCwfmsMpjp9bB3dp6euMRlCHjYMc9cb-r7brmNScdp76lnRC-2xXDjiAHJaDr_cISKKOTlqzn59Ek51_xAbKwBp-8bD-_ziJIols0zwDgYVQ2ddpBdETrxQzBkywXVIXoGpoWHJ4h2Ltdh0DB2lt4O6EIzjsqkotuz6X2dC0lFgOfsz2EXn3HbLlfp-YzCMLaG-OArJDeWLkfrRCgpeNihZcm2-UftPOIcwLO0GYsdVOar7vdIDcfH7kLMNt0_ocjYLp-riPsswGDM8kh0bTO3xMG8wvbJUf_KA-ql3MtJrMtAl5J6-mJYusqpIygMrivtCz6ZBrqWBaGtfRRRge7qKLbY-5uqayoxUCgsRL8Vdz1Lp5NuLuvSnrHRF7x8hOAlAYIJdhcU6h79cBdsYqJTxEbPf0RjC-Ia8KV0q-2QkgOjSCtm85_uc7eBODCDAkFQk8adU1o_Ec2RgYOvxK6GueE1jmmdqHUUADKG1wiJ4R4F3jCFJlSk8skeM5YWTwAy482S5jw0TuXjYKSHbLKX_GXFjvy-IpQvLvmaDATh_6PgE0LaLC32Tq2WUs2H76noOqgWX1wZkEq8dNpebwk0azdkIrSFseCEDm_pIaX0LOjH6nyZpX3iZ7q6KoU0ENxc2SczrpnhF31kwTHVpZLuediWUiHWMOUcTeoKt90WJq7dScgudjxeXsSHQ6I4X61X59fF4tpNTQPZrCyoReUUzRJ2gRs3NB6hssVlHgss6PP4e5dmEyRUYe2jfG8pOyK7fRwjcFi2oJI2Z5MzR6JR6bWgx5Oli0Ctqvmm41P2zUDy87eysBnBDwqW65udy17UavaVUh0Xes4asGHRAslpnkP718ZgrgUMWY53ZbHYzYSdWkIa_8KdEwFB8bPEWkHGHi2ftqArqIFZO9rroNc6DxbgDvTEgFanIiB0LMA2GE09QRyZ2iovhQ5e7GlGny305Bb3-nLjOAq0OzDq7if8vTPwXsT1JrzOJWhQOGfMVYg88RLcpvQ-5a8R4nbKKjMmoXwUkJHmgZZpkvhZbZREe_D1M2NmtKMlKcCzx7iQRcf2Tj000TQfFjiQ7ABGiwuOlMfEUMPEhbkLuFGFkaMN8royMJB-ImsNC2I6PZOuykNT9gRi7qEAGAPcBsOoenkO2EE9R4KMMps9mclUk7Q3zy9OVg9Ldso-L0KLU4gZ9plk2V679J5SJZ2puohUvlG3hERdzmnBVDhoHrjkRVrb3jvPguuMv85lE88cpdDShrwHKKy_Hcbwlqgz1VHoxNxwfe0R-BMo3xXBGs2Prmiz-PjVBdSsIe1a_fykaRG3DnY5drQi_f_xvHCBVNe-orm0vI6nZxjfyR4egnk06w6xZRMmGfOvVi7dhNDLMcIprQEc055p-udeX9SxwN0CGypbwb0IHCC_AtaLtze8YuIJvJiIMQTQOCja5qCPNvwvq6I1IT1YE4i5_uP673dcHj_syHWQ3I1sHGf_xIVftrPzlXtvrlTljcJpm6dtIg5_hvlnCCLhpzUhybnydJxro7dE9kxcsWKdkQUYo65z9BijW2STgyuf6uZ1K_d52jK--lz4QMlB1rK64PfjhHfimePFH2engStgFxly3gu2U_IzMhJMX14-yVrYsLZzj1AwwNgSIHd8W812Oo-iYdilWxBP-7kPGKQZ6aT3Qey6Ghxixy7Sw1-wFfp2P0S5KGfz5MYgOrzEGoBRX0euQRtXSqEhB8VmAdCAw3QuAr7vduyo8vOnT48seBT_n3Ju3qkPMnd2EhfLyMfOCL7ZeGHMya5RR8T8J6J7sdkOSakQG98C2uAWl-_L9hngIGX4JgCNtDb8kadEp3C4xrQd-XAmP4h6SY68ycq49GGqY0O25lEEaUqj3BelbX0qyaRG4TSWNZhQmQuzkGYtdu3bXN1RSJJMJlmUOx2s4-zrFxt9oBjfc3jbpicznB8Glryxajpbnfkl25cMrDTCdluCN4r8tbit6hGJIjG3XCQIyGdkyBljdZ4rZqbLtyrpuOoS5Qa1LVY5UQulEDJ0WqdnU0E-KnL_Ho75mGllxRVnvL7IzFXOxzOciVI08-2mfPAwMoubjlkaeDXIxEVYQub1ni9JHtZ6IF96rREH55Brc6C1nIKEcwVOVTAo_yS21YHO3gfr5UrsYeHXHIvijNvRCD2fvYlLIeIzvpIfbu7dxTL4PcBw-9fvHp1NAshsV5PVOS9on-ONEZwykCXZJVs81hnqXZEnFbNPeSWk9UAn2eUF5PevmbLgY9vaYiPpBl1VYf7Zmk1CfB-NaSXCKoz5GB4GPs55mxk3WKOCpLtiPjRjllHnF--GpC3rVAirpFnC2L3g8ByslD_IOuMpWjlu8Zt_3E_ZT4UR-hDVsaNPivRKTRAGQDDfNHgXqRYQXeLXgwegazK9n8hUD6KbRTRBtScS6djkW7AHzbY7kggn_kS9wh_spNX0J1aRfcukKt5bXjlOjC3mCHv0flfswc5lj8CsYCkqOx1BDPZHpPniXqQjhNFU16TyVor1sqnoqLSDKHYcT7xFYZLYFMCambQ187rS3dldGJ3bxCrE43Bnx9Br3cSKbSbajyxZ4C-YCMghNH_sO11x0oi_eFl6yez1F9f2-rlhx0_b5QD9mwHDl-lp5b1GBxhNJDzr5j0_EWSM-axu3787mkBxXF0nexQ8ir4_hdw1ZnRmjskLsr7BCRuwLgV-xtsfnBsv4WK-OHh5naYM-Jfl-rvCuw7VlsbFNfRAJqhe2b83nJ7KEHLbKW1ddKW_Ne_I2I9AutxQH-aa0TnNM1OOJZw4NDcL7ItbyaaxYPob-qdenxh4Wn6dVSQuXqxOFD_wv08U8rhv9nHJpju0vW_vLJQmuhGUxQEYSspouRf4yWj4JYr-xocpEWHjDn45imndyI6bNQaKiTTZEIFWGjdbCdrGmKtsrtZmMEP3Z-NfJVyyptbEpGm4UIYjJdrEvXIWOsUCdV7gDx6kQSL2n9gFl3e-OllQmmsBefzY3ln3WAgUWwg0K_Uj4-n6iJW1jkUqJE2XjzQTnC0ncKc2OHbBRkz8g3WG0TTS9M1TtBmTMsS5eEMw967I6lJrlB7lQSK8ZeqAGtoj0Df8Ej-yXn1btH5fvSHoxKduV29Dj2SI0kRDHXIhvUUAhbVtjzbEAlquxa5wHbU9YEb2KehmCrm8hsGX6_y22nd9DKEYuJ2Vd21U7QPEb8OzLdvODjLPGjSRYEO4Ed1M8Ljg1pVm5GuznbhKhNxHDqN2UmGt8-ZECE_ce6llhuvdkoxIhsvx0JqeIqBw9c1MO6rnzL6PxxtbmgrIr7E4VlniYonMRvxk5z2WEWuAB7azmDmLV23qTEXwf1Cwr2s1GteRbfYG-izszkU0&pr=8%3AE1DDD3F954D276F4&cid=CAQSMgDICaaNA8b58p423k4yzHG5Died2eT8chatLfWI7pZyiNvZCZgTakLuI9-Z9Pzqyv9QGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Fhelopal.club%2F&ds=l&xdt=1&iif=1&cor=13541817837438583000&adk=250276039&idt=149&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c96b29253ad99be379f0fb6810b701fdff2071411f2b2dc0237314490aa428f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40315
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK logo.png
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyp5xwz7/ Frame 4B21 11 KB
12 KB 40ms
39ms Image
image/png 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyp5xwz7/logo.png
Requested by: Host: joyn-creative-hosting.s3-eu-west-1.amazonaws.com
URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/baseanimation_su.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 4d49809a3e7379f46dd69f308337cd8c570c31e539c33e3183ace04b7935f802

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Thu, 30 Jun 2022 09:22:42 GMT
Server: AmazonS3
x-amz-request-id: PBBAMMRFJBXAFMNB
ETag: "b65585e8a39ffa47975c42b9cddaf2e9"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 11723
x-amz-id-2: ru2rUlxJwR8UrXy0Km/AZlRYG88nErJM2NPvTft1xdoyxwJ3bd+apfzXrfs2GiJ5wQNz2DuohGWsumjsMZFUow==

GET
H/1.1 200
OK sat1-gold-medLib.svg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/ Frame 4B21 1 KB
1 KB 38ms
37ms Image
image/svg+xml 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/sat1-gold-medLib.svg
Requested by: Host: joyn-creative-hosting.s3-eu-west-1.amazonaws.com
URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/baseanimation_su.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 088a736ef08892e4bd88c860153761272be22358fa2e3f82f92a9e6ffacdbb82

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Wed, 16 Dec 2020 09:18:30 GMT
Server: AmazonS3
x-amz-request-id: PBBB8H7AFBMTYSKK
ETag: "b01e1fb8641e38c14d25a48df24813c3"
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1145
x-amz-id-2: O5e4bqht+fX0mCyL/lLfTURLlqlySTghookzw0Uhz3cYx43QOem+IuC63LueYq2M1XeHwhp5u4sVyhQfulkeqA==

GET
H/1.1 200
OK logo.png
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyoor9au/ Frame 4B21 4 KB
5 KB 37ms
36ms Image
image/png 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plavyoor9au/logo.png
Requested by: Host: joyn-creative-hosting.s3-eu-west-1.amazonaws.com
URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/baseanimation_su.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 56fedd576ff4a20677e36cf4a3464674224723d71f39af53d846a9a261446e70

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Tue, 04 Jul 2023 13:25:20 GMT
Server: AmazonS3
x-amz-request-id: PBB6JT8S228MWP9N
ETag: "29df3ed88ee60bf8440fd4367a874fec"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 4464
x-amz-id-2: jfsK4J7Iq5yCCEU4A1z16PBJHeKvcv1UlziiTLjH8oy3kOIOBgc0x63GV4mriRqjYqrPJWVNcZak6QZB48y/pw==

GET
H/1.1 200
OK logo.png
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p1bp931e2rp/ Frame 4B21 6 KB
6 KB 38ms
38ms Image
image/png 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p1bp931e2rp/logo.png
Requested by: Host: joyn-creative-hosting.s3-eu-west-1.amazonaws.com
URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/baseanimation_su.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7b006c26b599c26431ec98f5891b32af7dd70a9a19397e5147a9ca534d2132db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Tue, 04 Jul 2023 14:07:39 GMT
Server: AmazonS3
x-amz-request-id: PBB3D4XHP4NQ3S5R
ETag: "fffdd48e920b60c5e7c051438fbbf195"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 5804
x-amz-id-2: 2732/RSOAdKNoeYxMM2ZT7QQRunB8yTfFQLiTBWXP/AfWYclsofXna2U4jKy4GXMjfNYnYxirkJqcKzX6qIIUA==

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 424E 172 KB
60 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Origin: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 19:32:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70068
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 08 Dec 2023 19:32:51 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame 424E 11 KB
4 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DKSRi3YrVm9W2uwHig7CRfliRY4PDJ0cteNa1Z-1VbVNSy9Nkzq3FW-O0F584mZEITJyOAufNyhaauys_7oMrRrt2GRbf1Vkg0n5aR1fMBPlzRChfol6NaYtIpc0Gyz5ILOrUw6ud0xZaH0RObvPmV8IrZogo2HWwXBSSj5VpBpQb8_iw&dbm_d=AKAmf-CAmLDqXj40pBOWMTmrMNaazA8-PeMvJHS341wldaiEmSapc5NH-mC3FDTXAB5DE29ze9j0HWebOINgL04uogGHgKzsSROe58DbZGSCG3bRyDhKm9AKCa5xM0LQSGvXfzCwfmsMpjp9bB3dp6euMRlCHjYMc9cb-r7brmNScdp76lnRC-2xXDjiAHJaDr_cISKKOTlqzn59Ek51_xAbKwBp-8bD-_ziJIols0zwDgYVQ2ddpBdETrxQzBkywXVIXoGpoWHJ4h2Ltdh0DB2lt4O6EIzjsqkotuz6X2dC0lFgOfsz2EXn3HbLlfp-YzCMLaG-OArJDeWLkfrRCgpeNihZcm2-UftPOIcwLO0GYsdVOar7vdIDcfH7kLMNt0_ocjYLp-riPsswGDM8kh0bTO3xMG8wvbJUf_KA-ql3MtJrMtAl5J6-mJYusqpIygMrivtCz6ZBrqWBaGtfRRRge7qKLbY-5uqayoxUCgsRL8Vdz1Lp5NuLuvSnrHRF7x8hOAlAYIJdhcU6h79cBdsYqJTxEbPf0RjC-Ia8KV0q-2QkgOjSCtm85_uc7eBODCDAkFQk8adU1o_Ec2RgYOvxK6GueE1jmmdqHUUADKG1wiJ4R4F3jCFJlSk8skeM5YWTwAy482S5jw0TuXjYKSHbLKX_GXFjvy-IpQvLvmaDATh_6PgE0LaLC32Tq2WUs2H76noOqgWX1wZkEq8dNpebwk0azdkIrSFseCEDm_pIaX0LOjH6nyZpX3iZ7q6KoU0ENxc2SczrpnhF31kwTHVpZLuediWUiHWMOUcTeoKt90WJq7dScgudjxeXsSHQ6I4X61X59fF4tpNTQPZrCyoReUUzRJ2gRs3NB6hssVlHgss6PP4e5dmEyRUYe2jfG8pOyK7fRwjcFi2oJI2Z5MzR6JR6bWgx5Oli0Ctqvmm41P2zUDy87eysBnBDwqW65udy17UavaVUh0Xes4asGHRAslpnkP718ZgrgUMWY53ZbHYzYSdWkIa_8KdEwFB8bPEWkHGHi2ftqArqIFZO9rroNc6DxbgDvTEgFanIiB0LMA2GE09QRyZ2iovhQ5e7GlGny305Bb3-nLjOAq0OzDq7if8vTPwXsT1JrzOJWhQOGfMVYg88RLcpvQ-5a8R4nbKKjMmoXwUkJHmgZZpkvhZbZREe_D1M2NmtKMlKcCzx7iQRcf2Tj000TQfFjiQ7ABGiwuOlMfEUMPEhbkLuFGFkaMN8royMJB-ImsNC2I6PZOuykNT9gRi7qEAGAPcBsOoenkO2EE9R4KMMps9mclUk7Q3zy9OVg9Ldso-L0KLU4gZ9plk2V679J5SJZ2puohUvlG3hERdzmnBVDhoHrjkRVrb3jvPguuMv85lE88cpdDShrwHKKy_Hcbwlqgz1VHoxNxwfe0R-BMo3xXBGs2Prmiz-PjVBdSsIe1a_fykaRG3DnY5drQi_f_xvHCBVNe-orm0vI6nZxjfyR4egnk06w6xZRMmGfOvVi7dhNDLMcIprQEc055p-udeX9SxwN0CGypbwb0IHCC_AtaLtze8YuIJvJiIMQTQOCja5qCPNvwvq6I1IT1YE4i5_uP673dcHj_syHWQ3I1sHGf_xIVftrPzlXtvrlTljcJpm6dtIg5_hvlnCCLhpzUhybnydJxro7dE9kxcsWKdkQUYo65z9BijW2STgyuf6uZ1K_d52jK--lz4QMlB1rK64PfjhHfimePFH2engStgFxly3gu2U_IzMhJMX14-yVrYsLZzj1AwwNgSIHd8W812Oo-iYdilWxBP-7kPGKQZ6aT3Qey6Ghxixy7Sw1-wFfp2P0S5KGfz5MYgOrzEGoBRX0euQRtXSqEhB8VmAdCAw3QuAr7vduyo8vOnT48seBT_n3Ju3qkPMnd2EhfLyMfOCL7ZeGHMya5RR8T8J6J7sdkOSakQG98C2uAWl-_L9hngIGX4JgCNtDb8kadEp3C4xrQd-XAmP4h6SY68ycq49GGqY0O25lEEaUqj3BelbX0qyaRG4TSWNZhQmQuzkGYtdu3bXN1RSJJMJlmUOx2s4-zrFxt9oBjfc3jbpicznB8Glryxajpbnfkl25cMrDTCdluCN4r8tbit6hGJIjG3XCQIyGdkyBljdZ4rZqbLtyrpuOoS5Qa1LVY5UQulEDJ0WqdnU0E-KnL_Ho75mGllxRVnvL7IzFXOxzOciVI08-2mfPAwMoubjlkaeDXIxEVYQub1ni9JHtZ6IF96rREH55Brc6C1nIKEcwVOVTAo_yS21YHO3gfr5UrsYeHXHIvijNvRCD2fvYlLIeIzvpIfbu7dxTL4PcBw-9fvHp1NAshsV5PVOS9on-ONEZwykCXZJVs81hnqXZEnFbNPeSWk9UAn2eUF5PevmbLgY9vaYiPpBl1VYf7Zmk1CfB-NaSXCKoz5GB4GPs55mxk3WKOCpLtiPjRjllHnF--GpC3rVAirpFnC2L3g8ByslD_IOuMpWjlu8Zt_3E_ZT4UR-hDVsaNPivRKTRAGQDDfNHgXqRYQXeLXgwegazK9n8hUD6KbRTRBtScS6djkW7AHzbY7kggn_kS9wh_spNX0J1aRfcukKt5bXjlOjC3mCHv0flfswc5lj8CsYCkqOx1BDPZHpPniXqQjhNFU16TyVor1sqnoqLSDKHYcT7xFYZLYFMCambQ187rS3dldGJ3bxCrE43Bnx9Br3cSKbSbajyxZ4C-YCMghNH_sO11x0oi_eFl6yez1F9f2-rlhx0_b5QD9mwHDl-lp5b1GBxhNJDzr5j0_EWSM-axu3787mkBxXF0nexQ8ir4_hdw1ZnRmjskLsr7BCRuwLgV-xtsfnBsv4WK-OHh5naYM-Jfl-rvCuw7VlsbFNfRAJqhe2b83nJ7KEHLbKW1ddKW_Ne_I2I9AutxQH-aa0TnNM1OOJZw4NDcL7ItbyaaxYPob-qdenxh4Wn6dVSQuXqxOFD_wv08U8rhv9nHJpju0vW_vLJQmuhGUxQEYSspouRf4yWj4JYr-xocpEWHjDn45imndyI6bNQaKiTTZEIFWGjdbCdrGmKtsrtZmMEP3Z-NfJVyyptbEpGm4UIYjJdrEvXIWOsUCdV7gDx6kQSL2n9gFl3e-OllQmmsBefzY3ln3WAgUWwg0K_Uj4-n6iJW1jkUqJE2XjzQTnC0ncKc2OHbBRkz8g3WG0TTS9M1TtBmTMsS5eEMw967I6lJrlB7lQSK8ZeqAGtoj0Df8Ej-yXn1btH5fvSHoxKduV29Dj2SI0kRDHXIhvUUAhbVtjzbEAlquxa5wHbU9YEb2KehmCrm8hsGX6_y22nd9DKEYuJ2Vd21U7QPEb8OzLdvODjLPGjSRYEO4Ed1M8Ljg1pVm5GuznbhKhNxHDqN2UmGt8-ZECE_ce6llhuvdkoxIhsvx0JqeIqBw9c1MO6rnzL6PxxtbmgrIr7E4VlniYonMRvxk5z2WEWuAB7azmDmLV23qTEXwf1Cwr2s1GteRbfYG-izszkU0&pr=8%3AE1DDD3F954D276F4&cid=CAQSMgDICaaNA8b58p423k4yzHG5Died2eT8chatLfWI7pZyiNvZCZgTakLuI9-Z9Pzqyv9QGAE&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&dv3_ver=m202309260101&rfl=https%3A%2F%2Fhelopal.club%2F&ds=l&xdt=1&iif=1&cor=13541817837438583000&adk=250276039&idt=149&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 14:00:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3582
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 14:00:57 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 424E 31 KB
12 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6cbe31747c16c069d861a8ed01b15186eaee8c381f74ca1712087811c39f4d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 19:10:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71380
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11943
x-xss-protection: 0
server: cafe
etag: 4141415479739543000
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Dec 2023 19:10:59 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 424E 41 KB
14 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 593731
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame EC90 281 B
555 B 24ms
23ms Document
text/html 2.19.217.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
Requested by: Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.217.60 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-60.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Dec 2023 15:00:39 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame EC90 46 KB
13 KB 28ms
28ms Script
text/html 2.19.217.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.217.60 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-60.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: b35795583c515533313898d0e14334b4434610737c7acb1ae0846476559a2114

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:39 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Dec 2023 04:50:38 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=49790
Connection: keep-alive
Content-Length: 13232
Expires: Sat, 09 Dec 2023 04:50:29 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame CFC1 38 KB
13 KB 51ms
51ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 280154
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 09:11:25 GMT
expires: Wed, 04 Dec 2024 09:11:25 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame EC90 7 B
380 B 9ms
9ms XHR
application/json 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 424E 202 KB
64 KB 134ms
133ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Dec 2023 15:00:39 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/3405547488589800225/ Frame 8F3D 10 KB
2 KB 63ms
62ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3405547488589800225/index.html?e=69&leftOffset=0&topOffset=0&c=iagmcXql9V&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d1c59052179f67fe051442f53bc6e57fa5e800dee6058ac039fae663519b26d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2432
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:00:39 GMT
expires: Sat, 07 Dec 2024 15:00:39 GMT
last-modified: Tue, 24 Oct 2023 09:25:58 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 424E 0
0 80ms
80ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstF3nD2EBuvozD9b6Ju-pHMARezM-iUSj_OW7y_iLkg4ML21N7j_d2TjHTTdNx-ZQkHP2AwMrjzKtOS_hDpbPn4DgByeZefQBVQgdDJcy3a6N2GYDpTsRcVxbQNzsZrrkE4uNjb6emPq4mHf8AhFku2qzXbRU2NAxJR1RHhnspjUbqklHgk1MuQF0t44yX_pFNZM29PHUEawrU-UCQwdLFNHePYvZMUPqT-ChsHeZO8JlMPoJhnlByfnb6DSyFChTuF_ZY03vuxtAVnKtafBjiW_kkSH6yIRA6LGSMQmt6UemXHSzpE7rrqH28ip1rTCsOU2TIWKBtArt5at7wwMIXOxeGECuQAz1zCTelA53o51f8m1umIXBZoiGccGLl6Cnwn5jrxfjQHgfsj6tBfS8JhCF8huRCqt10bBzaxn4SmDOJIdTi-lfGvG-5wjNahmyWq-7xMv3nPoPccK9LYOlGd7DFBiFM8nXzLoDK7vRMP1GhTJiJhSbb-eS6WnaHv42NCDNCAjBDH9i4Be_4PzCOfQpC037ysn9UVz6izP_TfcGRM0Wrb5C_xcyTy5obG6qMPUBT1YnWRNLjY5UdyaVksyoMILXKqmmeOOw0qcDypIa-GELse53_PParo0xGnhzuim_f1rEpbqKg2CqG_6-CLxH-pBQRqDOTTSjZduq3gjc1tEcTpVmPAHGa9wyJafzC0rNTPqhHoCh8Cwumj6H--Fhw7SIxYuJhQXNSmftMuquHaFGomzKfoqtV1aGB6VvondAT_wMdWsU0chthQQmp82DQ_2n3-oPtJXmKlCxMIMOBE41bX5cZXhiiMpZMOSHDVhoroIXCAfRLqkKUROn-U-IGojUlRGX_9yDJpHZs7ftIcrOXT8HcEVmGW3CW2aPRPQxcqhebDSwQGdKATiroTf6IhbUKXgFGRGpnIl5zmKNjRlVjy4_ccsyODhV5UFEX_muCBdQpVgg8nEYONHGvnV9UCQ4EE3LUH_UvH_pgDLwz4KPj5UXcSrss7VxMslb2UNdf5npdGbW5ZDGOhOEpT7HNMKrBiXP7kZHPRTOeLZxFi7A4mqJdlMwXFDIcAQYVK-VEiCoSoddUh4t1rIjHkeJlhe_68-IlqcXuV5NJ0i7c8_LcHT5stdHhGNQXr_dQGF47aDUgZOLq2YJuZsRs8C2dP8E17i5l6CSI5N8gt8sOxdOxbRDnOfz51SyRnuqfuVkLl9Jd8fVzGnARiWE21Eo9yrhjVdGvPDTiCWU4JUqOvGiCguqKYB1DJ3sCDzIiC2nanEVpZDhgmSh_9f1fLjnjGvSxK6zbQzj1R6G-euw&sai=AMfl-YTaY6WyrVxaIzuHNTtoO1aGPi81J1WTJU6oZat_lKbwvV-tKND6eParWZtua3JTyRd7vP-0i19hXqMMbFroj_XnH2G8KQWjpYOETyqKZaUeLAzF47dtHw9pTgnT-QVMeRYm23ZF8xhUZY6bB7OTmINumYu7I6PqhmZf62c_73Vo7ZDQQ0dcY6NZ-UbGBC8eNe-MOfHyOt55YeawS6c3JK_St_BfumT-TC8dpckQxvVeDZAuQY-w-Uk6gYGhfVGGCCD4CazmKjV40rYIjFk2&sig=Cg0ArKJSzBuyz7-R_IY2EAE&uach_m=%5BUACH%5D&pr=8:E1DDD3F954D276F4&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=121&cbvp=1&cstd=118&cisv=r20231206.20269&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame CFC1 39 KB
15 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 14:57:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 204
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 14:57:15 GMT

GET
H3 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8F3D 57 KB
23 KB 75ms
74ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3405547488589800225/index.html?e=69&leftOffset=0&topOffset=0&c=iagmcXql9V&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3405547488589800225/index.html?e=69&leftOffset=0&topOffset=0&c=iagmcXql9V&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 08 Dec 2023 15:00:39 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 8F3D 120 KB
41 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3405547488589800225/index.html?e=69&leftOffset=0&topOffset=0&c=iagmcXql9V&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3405547488589800225/index.html?e=69&leftOffset=0&topOffset=0&c=iagmcXql9V&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 12:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9430
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 12:23:29 GMT

GET
H2 200 polite.js Show response
joyn.kr-adstudios.com/img/banner-js/ Frame 8F3D 86 KB
87 KB 16ms
16ms Script
application/javascript 2600:9000:2447:9600:7:dde5:8880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://joyn.kr-adstudios.com/img/banner-js/polite.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3405547488589800225/index.html?e=69&leftOffset=0&topOffset=0&c=iagmcXql9V&t=1&renderingType=2&ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2447:9600:7:dde5:8880:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

f56cf558e4526ba5116061cca5bdffdb159449245b4d202251e29ad1b7ffbfde

Security Headers

Name	Value
Content-Security-Policy	default-src https: gap: ws: 'unsafe-eval' 'unsafe-inline'; img-src * 'self' data: https:; font-src 'self' data:
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 09:11:48 GMT
via: 1.1 87e83cc6e8f384d40eab78133e901302.cloudfront.net (CloudFront)
x-content-type-options: nosniff
content-security-policy: default-src https: gap: ws: 'unsafe-eval' 'unsafe-inline'; img-src * 'self' data: https:; font-src 'self' data:
strict-transport-security: max-age=63072000; includeSubdomains;
age: 26453
x-amz-cf-pop: AMS58-P5
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 88197
x-xss-protection: 1; mode=block
last-modified: Fri, 13 Oct 2023 12:00:00 GMT
server: AmazonS3
etag: "be0097968a4b98b9427d98c7c07f9716"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
x-amz-cf-id: dgQ2kRIoH_n4NG39lgZJlNdi1FalcoiLF2VIhEUuHKSDVPViTZAm8g==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CFC1 0
20 B 90ms
89ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BybkQly9zZanXIPngx_AP7LWkyAwAAAAAOAHgBAI&bg=!0dKl0p3NAAY3kmNgF5I7ADQBe5WfOBtFeqgtRS8D3W9H8TInWGMNg4APgMD8OQyMRapVByMsan8UdO0Ft1ry99KlCgidAgAAADZSAAAAAmgBB5kDgyraMbfbyxKC_AaBfIG3-gAc_AtUieoaEHxMIonOVobOJfi3ZGnEdslf7SBZCusQZo2bEZ5TIrKpuZaBxdWxu5gZyaEHnirHrzAGoyowzdkoyxw38zDSzIrs3fzLEjrw9S1DcdYyyuw65xx2_ix_U6xVrushhyYqnAe7J7W561UOV_wOleRXUdO5Ohmsm7NCvjGEAzcVS3K6_uOPysgUyYhUFm5eNGmhf-a5VsE3rHQ9DONLFEaEaZxoE5fWHR22PYJHCwT8-aBUE9MEgZIKD89Rry5EjIwhbwIp57Hbnvwub1dqhwgdynjyVR5qxDcnqW0lUYtNwylCmymMENQbG_hMplnQdAB3L62xCQMGV-UhbZI8oIj1CX90llNcOEoes_HRAJ6RX5VdnWYKTfZCSlo488YLF8JzWncYVazIn90NgTlEzst_U4R1WmIEfcqrPphK0ayp0h7WJPP8fpP_NVbV_JNUCtS0NC3zwjUh1_SrKhDqudHjFO2wEPVD-z2uMxeI2a9b1SaX_UouiScyLp-kxb07HKUh6Vu0mAgZGo-or-4krxNohs8wg9BB1h-1KVqMQnnUupW3qfmC2C8cWPvmxbhDOFptSLCLRfsZHkC9joJ1WQcesF5jSBwbJnWxSFbwBFn50nZuDa8WWWej2MoHoye7jb3-sip0ouQdAJQCAojrYXduwQuzK6ub-ZwhhiZQEgIK8A08cx7Y_dh_-BzJzfVMTpr5gk5wpVYvb-W7a_GTh26VUc141ReuaH5R67-nNg8KXcu9fv9r0EksJyvCFN_m1wBsy-hPPXcdYfHGSmUMg5E3l7BppSL-OxDyJ7ii0Jhq2F4wmdBdzPVHs74N2MTRK4TXNBuEuWXqtYZ1kmC2YXk9ccxkN6jSCNvyRlrUdDqA16hgUKz1u3IGOBpfmi5KFfp205R9E7SAVsjmc3_5MWdJGV3hUW5x0ebF6J7JFsRgij2igiSKrYxg_53UtwsMiBEuTKjs5NrSxLRuDms2y8Ot3qVwHQJGlfcxFdup_U70UWXIFo4YvSnCO3Aos8Rl5O5vq4s5XRCUQFGemCkuC773ofFaxWyJstaGYeUwcICJYM6vGZNZ4Cg_p74_X4sNQ03CTR8XqScuKPLU5J10ELEZ1JiCTPizEgCpPLDWjtBqIDm_bLrRJFI3NW9j-FxRANyVjJUrd8xy3AFGOxTk

Requested by

Host: 559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com
URL: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 8F3D 18 KB
0 Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 8F3D 17 KB
0 Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 424E 0
0 74ms
74ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstF3nD2EBuvozD9b6Ju-pHMARezM-iUSj_OW7y_iLkg4ML21N7j_d2TjHTTdNx-ZQkHP2AwMrjzKtOS_hDpbPn4DgByeZefQBVQgdDJcy3a6N2GYDpTsRcVxbQNzsZrrkE4uNjb6emPq4mHf8AhFku2qzXbRU2NAxJR1RHhnspjUbqklHgk1MuQF0t44yX_pFNZM29PHUEawrU-UCQwdLFNHePYvZMUPqT-ChsHeZO8JlMPoJhnlByfnb6DSyFChTuF_ZY03vuxtAVnKtafBjiW_kkSH6yIRA6LGSMQmt6UemXHSzpE7rrqH28ip1rTCsOU2TIWKBtArt5at7wwMIXOxeGECuQAz1zCTelA53o51f8m1umIXBZoiGccGLl6Cnwn5jrxfjQHgfsj6tBfS8JhCF8huRCqt10bBzaxn4SmDOJIdTi-lfGvG-5wjNahmyWq-7xMv3nPoPccK9LYOlGd7DFBiFM8nXzLoDK7vRMP1GhTJiJhSbb-eS6WnaHv42NCDNCAjBDH9i4Be_4PzCOfQpC037ysn9UVz6izP_TfcGRM0Wrb5C_xcyTy5obG6qMPUBT1YnWRNLjY5UdyaVksyoMILXKqmmeOOw0qcDypIa-GELse53_PParo0xGnhzuim_f1rEpbqKg2CqG_6-CLxH-pBQRqDOTTSjZduq3gjc1tEcTpVmPAHGa9wyJafzC0rNTPqhHoCh8Cwumj6H--Fhw7SIxYuJhQXNSmftMuquHaFGomzKfoqtV1aGB6VvondAT_wMdWsU0chthQQmp82DQ_2n3-oPtJXmKlCxMIMOBE41bX5cZXhiiMpZMOSHDVhoroIXCAfRLqkKUROn-U-IGojUlRGX_9yDJpHZs7ftIcrOXT8HcEVmGW3CW2aPRPQxcqhebDSwQGdKATiroTf6IhbUKXgFGRGpnIl5zmKNjRlVjy4_ccsyODhV5UFEX_muCBdQpVgg8nEYONHGvnV9UCQ4EE3LUH_UvH_pgDLwz4KPj5UXcSrss7VxMslb2UNdf5npdGbW5ZDGOhOEpT7HNMKrBiXP7kZHPRTOeLZxFi7A4mqJdlMwXFDIcAQYVK-VEiCoSoddUh4t1rIjHkeJlhe_68-IlqcXuV5NJ0i7c8_LcHT5stdHhGNQXr_dQGF47aDUgZOLq2YJuZsRs8C2dP8E17i5l6CSI5N8gt8sOxdOxbRDnOfz51SyRnuqfuVkLl9Jd8fVzGnARiWE21Eo9yrhjVdGvPDTiCWU4JUqOvGiCguqKYB1DJ3sCDzIiC2nanEVpZDhgmSh_9f1fLjnjGvSxK6zbQzj1R6G-euw&sai=AMfl-YTaY6WyrVxaIzuHNTtoO1aGPi81J1WTJU6oZat_lKbwvV-tKND6eParWZtua3JTyRd7vP-0i19hXqMMbFroj_XnH2G8KQWjpYOETyqKZaUeLAzF47dtHw9pTgnT-QVMeRYm23ZF8xhUZY6bB7OTmINumYu7I6PqhmZf62c_73Vo7ZDQQ0dcY6NZ-UbGBC8eNe-MOfHyOt55YeawS6c3JK_St_BfumT-TC8dpckQxvVeDZAuQY-w-Uk6gYGhfVGGCCD4CazmKjV40rYIjFk2&sig=Cg0ArKJSzBuyz7-R_IY2EAE&uach_m=%5BUACH%5D&pr=8:E1DDD3F954D276F4&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=283&vt=11&dtpt=162&dett=3&cstd=118&cisv=r20231206.20269&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: helopal.club
URL: https://helopal.club/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2276 0
0 93ms
93ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv6G2GoqANPRNjdk0UfKAgYyWlhaZnncAs_AoytsZ1kxpz4Mf6ekaZqmzvCwMBGzf51BVrhoHfLiDe3RWsXY6_bJSaheG8ok1LnuxX3amJpWXLeC0mulUnCphpDbqCm3JDv4mLsrSBThpGmVoNJrTU0Bhrzu_vUoXdG3zt2yq3qrX2ZSEi7sLgoJDYjtSvbRmXDqWqpUv0q7qUyuTxpWSVrB0SqfiS7EkYv_Q8tB14iMtGiiFns03Y5hsXo6F9NJValtJZdb9NnhESJjRSBBG7wDWY-t2FGXabNz21NpDfJhLFFrW9yS9QUmrxgJPjT0gXupzJiVYw1Pexus20VzNG8t-4chKSJa-TNTTRw4wiqWl9e6y4ISVF17U5-6z95N-RFTcL1RuHdYayXt4FyDqngCA&sai=AMfl-YTDxU8ovOZx4L5NXRsGVbT_NXF9vH-ky0cMJZndwrpp04tFDR9GEsyRrGXWFCuLwip2sz1L0r4Xw-KENg-2nur28I5_pVKtJIj6L9Y8vq2m-C340PGPjosA-L_hGH-0t-ardm4eA5fl&sig=Cg0ArKJSzGC8XOBAzgfdEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://559462eaa8614037026d976f44dadbd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 08 Dec 2023 15:00:39 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 108ms
108ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231206&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f3b666ef50336c7de5cc6c489d851efcf67eaea7de3b1e8f5f7a6ef5ce1c1c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://helopal.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12221
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 8F3D 8 KB
6 KB 101ms
101ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a60b36abc4b3f0c735871ac3a7986270f37db1986cd68af6e0a87fc0136977e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:00:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5960
x-xss-protection: 0

GET
H/1.1 200
OK logo-joyn.svg Show response
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/ Frame 8F3D 864 B
1 KB 39ms
38ms Fetch
image/svg+xml 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/logo-joyn.svg
Requested by: Host: joyn.kr-adstudios.com
URL: https://joyn.kr-adstudios.com/img/banner-js/polite.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 8695956c55e8679652a5e34279fbcf353078c3883143582a847b8a26a50a3774

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Mon, 04 May 2020 20:14:51 GMT
Server: AmazonS3
x-amz-request-id: PBB69QPR0N8FK1CM
ETag: "4cfbd49bbe5134d80e544db8176b5503"
Access-Control-Max-Age: 0
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods: GET, HEAD
Access-Control-Allow-Origin: *
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 864
x-amz-id-2: ifYn12AclHAz870ptYLrLWWe0aMnv2GqsN4OX5OWDeN+Wz0OxUOgMBeGAMl/SCMjhNPqT8KclGyp85ZbHIOrOQ==

GET
H/1.1 200
OK sat1-gold-medLib.svg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/ Frame 8F3D 1 KB
1 KB 41ms
40ms Image
image/svg+xml 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/sender/sat1-gold-medLib.svg
Requested by: Host: joyn.kr-adstudios.com
URL: https://joyn.kr-adstudios.com/img/banner-js/polite.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 088a736ef08892e4bd88c860153761272be22358fa2e3f82f92a9e6ffacdbb82

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Wed, 16 Dec 2020 09:18:30 GMT
Server: AmazonS3
x-amz-request-id: PBBC3KKMGQ0CX8K3
ETag: "b01e1fb8641e38c14d25a48df24813c3"
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1145
x-amz-id-2: sX8Ng8HOAErtKGu1CW/5VC/INfa6exyKi597RV/8aH0EFs7Fw4GUTq8ztJ/t4VzpFSOTaIPkgiLM36U/z5dnxg==

GET
H/1.1 200
OK baseanimation_ss.js Show response
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/ Frame 8F3D 30 KB
30 KB 37ms
36ms Script
application/javascript 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/javascript/baseanimation_ss.js
Requested by: Host: joyn.kr-adstudios.com
URL: https://joyn.kr-adstudios.com/img/banner-js/polite.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: ab0a1cf5ba89fad9aeb1d7350394fa5f40b9ecc33ce6fd41a83363c9ba91e48c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Fri, 13 Oct 2023 12:02:57 GMT
Server: AmazonS3
x-amz-request-id: PBB7Y4X39N8T1K5S
ETag: "c592b9eb3a2091aa3a2d82a6b170baed"
x-amz-server-side-encryption: AES256
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 30590
x-amz-id-2: EXchMBIfrJJw2MZFFX8poiOBjGA3wucwixz28xYacwhlbWWzaCJXSKrtEsqo3BWYHWq/nWWm2kLakfbLLXKFUg==

GET
H/1.1 404
Not Found teaser3_@1.5x.jpg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p7btphfweei/160x600/ Frame 8F3D 0
0 33ms
32ms Image
application/xml 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p7btphfweei/160x600/teaser3_@1.5x.jpg?v=2023128160400
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H/1.1 200
OK teaser3_@1.5x.jpg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_pl5zauzid0z/160x600/ Frame 8F3D 16 KB
17 KB 60ms
59ms Image
image/jpeg 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_pl5zauzid0z/160x600/teaser3_@1.5x.jpg?v=2023128160400
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 75cc1fc95b80e404651e4d6f85cc01d24acbb3f092295d8a05ca3cf438796b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Mon, 12 Apr 2021 14:42:09 GMT
Server: AmazonS3
x-amz-request-id: PBB0JASJMEK8QHVW
ETag: "5d135a6e47528f74536efb77f364bc2b"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 16576
x-amz-id-2: Fy0at7driDwudTyzGSKmx2AhKAMkNGx9cW4fxjiaeoww/fY++pBU7RFNt+KCeLXGT3BMkDyoM554xFqBejnsjw==

GET
H/1.1 200
OK teaser3_@1.5x.jpg
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plhcvc4fbti/160x600/ Frame 8F3D 10 KB
11 KB 47ms
46ms Image
image/jpeg 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plhcvc4fbti/160x600/teaser3_@1.5x.jpg?v=2023128160400
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 3a22b9389e7fa4dea29d901ac471667d5fa0eb44b1038c30dfcd48b984c8a999

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:40 GMT
Last-Modified: Wed, 24 Jun 2020 12:13:11 GMT
Server: AmazonS3
x-amz-request-id: PBB9FDQC3QWW9GEC
ETag: "e83807e0b1d6644410d37b31155ce7c4"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 10386
x-amz-id-2: OAnxPzvhoSRQHEAgDmS/eP8fGoz3s8/0jlr7R1L16yiT/U6yRpnLm6BqNuwKdsiwDhD+RW3HYwYpQxXzdgN3aQ==

GET
H/1.1 200
OK logo.png
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p7btphfweei/ Frame 8F3D 5 KB
6 KB 46ms
38ms Image
image/png 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_p7btphfweei/logo.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: b3668721adba0d46e426f12438562a43d9d41f8f39b715d90493c54572f83bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:41 GMT
Last-Modified: Thu, 07 Dec 2023 09:20:38 GMT
Server: AmazonS3
x-amz-request-id: FC4A1Y4VESW0PKSC
ETag: "3c4d81e111f1d7bbfa4f05c3752b9a63"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 5348
x-amz-id-2: a+EQzOzgqf/kyhwIkxnl0iRSvjwsJclJwUDRgTwAKqlPG956ZWtIHAMjaQ1MLtve6k5NnqV4uZAcjLrhQmYTfQ==

GET
H/1.1 200
OK logo.png
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_pl5zauzid0z/ Frame 8F3D 10 KB
10 KB 42ms
39ms Image
image/png 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_pl5zauzid0z/logo.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: db9f74c4be168410761d216daca98585651cf8814315da4f63410b5a2bcee343

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:41 GMT
Last-Modified: Thu, 30 Jun 2022 09:25:27 GMT
Server: AmazonS3
x-amz-request-id: FC4BTK70Y3N0HJPH
ETag: "8afe0431f7f45a2011b822a7370e5ba3"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 10325
x-amz-id-2: 5DNcWK0taJiOJjatFuuhd+yY3THiqttTqsxKdeB13JPHzGqIn1I5GoF/S6ZiORc8MgMpKkq4sqP+F7Sq+hXtOw==

GET
H/1.1 200
OK logo.png
joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plhcvc4fbti/ Frame 8F3D 11 KB
11 KB 48ms
41ms Image
image/png 3.5.71.60
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joyn-creative-hosting.s3-eu-west-1.amazonaws.com/shows/d_plhcvc4fbti/logo.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.5.71.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 3406f425427f9f91c2b7d464c3b48a2c70efbaa52427964293295d323824ce60

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Fri, 08 Dec 2023 15:00:41 GMT
Last-Modified: Mon, 13 Feb 2023 15:28:56 GMT
Server: AmazonS3
x-amz-request-id: FC4C3P9Y054Q27MM
ETag: "fa3ca28a55e842ebc4dcb686abbce4bf"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 11030
x-amz-id-2: mlnph8Hx7eKDC/OBsGMmTd4XxOIKhhiCPit63ACyP8NIhMFEJfJWEPh2UWjOvdHpEY1uKc3j1bz4LsnZUUOZaA==

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 43ms
14ms Preflight
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fhelopal.club%2F&domain=helopal.club&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://helopal.club
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 08 Dec 2023 15:00:39 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 213781
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
370 B 24ms
21ms XHR
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fhelopal.club%2F&domain=helopal.club&cw=1&pbt=1&lsw=1

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Fri, 08 Dec 2023 15:00:39 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://helopal.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 231121
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
419 B 33ms
33ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=prebid&fmt=json
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 50243e8f6c9e7dca4838371bd97373a46750fb6ff3b45898bbb7f71b991eaca5

Request headers

Referer: https://helopal.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 08 Dec 2023 15:00:40 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://helopal.club
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
expires: Sun, 07 Jan 2024 15:00:40 GMT

GET
H2 200 usersync Show response
ssp.wp.pl/bidder/ Frame A5D8 477 B
319 B 80ms
79ms Document
text/html 212.77.99.29
WIRTUALNAPOLSKA G...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/usersync?tcf=2&pvid=74265074314660700000&sn=mc_adapter
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 , Poland, ASN12827 (WIRTUALNAPOLSKA GDANSK, Poland, PL),
Reverse DNS: ssp.wp.pl
Software: nginx /
Resource Hash: 636c486cc865655e882b671daac5c2edad7fa375be58a343d57364e385f6ebf6

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-origin: *
content-encoding: gzip
content-length: 281
content-type: text/html; charset=utf-8
date: Fri, 08 Dec 2023 15:00:40 GMT
last-modified: Thu, 07 Dec 2023 11:29:52 GMT
server: nginx
vary: Origin,Accept-Encoding

GET
H2 200 sync-all.html Show response
adxbid.info/ Frame 7E3E 7 KB
3 KB 85ms
33ms Document
text/html 2606:4700:e4::ac40:a70b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a70b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cccba065a0e962f62ca114793d18ada30e87cf7a48900c1e7486e8e4c57a05b9

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8325e116792d213d-CDG
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 08 Dec 2023 15:00:40 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l5QCdjDiLyWvHuPdKPWfRrlstt2OOp9IJobZAV0Mlxxtk8txTFo%2BnQoBP11xbJ8X49eFZz%2Br3q4K4p4uGFOrXP9LFjxY3MLrZtAAK20AAtpdZbXG07rPn3%2FYeXiOxE0KA4Eh1e02CKbnTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 204 /
onetag-sys.com/usync/ Frame DCDC 0
0 7ms
7ms Document
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1702047637020&gdpr=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 204 /
onetag-sys.com/usync/ Frame 6331 0
0 10ms
7ms Document
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1702047636914&gdpr=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 200 usersync Show response
ssp.wp.pl/bidder/ Frame BF6B 477 B
319 B 39ms
37ms Document
text/html 212.77.99.29
WIRTUALNAPOLSKA G...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/usersync?tcf=2&pvid=74265074314660700000&sn=mc_adapter
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 , Poland, ASN12827 (WIRTUALNAPOLSKA GDANSK, Poland, PL),
Reverse DNS: ssp.wp.pl
Software: nginx /
Resource Hash: 636c486cc865655e882b671daac5c2edad7fa375be58a343d57364e385f6ebf6

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-origin: *
content-encoding: gzip
content-length: 281
content-type: text/html; charset=utf-8
date: Fri, 08 Dec 2023 15:00:40 GMT
last-modified: Thu, 07 Dec 2023 11:29:52 GMT
server: nginx
vary: Origin,Accept-Encoding

GET
H2 200 usersync Show response
ssp.wp.pl/bidder/ Frame 490F 477 B
415 B 37ms
36ms Document
text/html 212.77.99.29
WIRTUALNAPOLSKA G...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssp.wp.pl/bidder/usersync?tcf=2&pvid=74265074314660700000&sn=mc_adapter
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 212.77.99.29 , Poland, ASN12827 (WIRTUALNAPOLSKA GDANSK, Poland, PL),
Reverse DNS: ssp.wp.pl
Software: nginx /
Resource Hash: 636c486cc865655e882b671daac5c2edad7fa375be58a343d57364e385f6ebf6

Request headers

Referer: https://helopal.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-origin: *
content-encoding: gzip
content-length: 281
content-type: text/html; charset=utf-8
date: Fri, 08 Dec 2023 15:00:40 GMT
last-modified: Thu, 07 Dec 2023 11:29:52 GMT
server: nginx
vary: Origin,Accept-Encoding

GET
H2 204 /
onetag-sys.com/usync/ Frame B299 0
0 8ms
7ms Document
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1702047636914&gdpr=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.36.3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS