www.balatarin.com Open in urlscan Pro
107.178.241.59 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.balatarin.com/
Effective URL:
https://www.balatarin.com/
Submission: On November 03 via manual (November 3rd 2023, 6:58:09 pm UTC) from US — Scanned from DE

Summary HTTP 206 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 39 IPs in 9 countries across 33 domains to perform 206 HTTP transactions. The main IP is 107.178.241.59, located in Kansas City, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is www.balatarin.com. The Cisco Umbrella rank of the primary domain is 703211.
TLS certificate: Issued by R3 on October 22nd 2023. Valid for: 3 months.

This is the only time www.balatarin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	107.178.241.59 107.178.241.59	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
7	52.84.174.27 52.84.174.27	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
34	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
37	52.217.17.238 52.217.17.238	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
1	52.222.166.41 52.222.166.41	16509 (AMAZON-02) (AMAZON-02)
10	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2001	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:4001:808::2006	15169 (GOOGLE) (GOOGLE)
12 28	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
5 11	172.64.151.101 172.64.151.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5 8	185.89.210.212 185.89.210.212	29990 (ASN-APPNEX) (ASN-APPNEX)
2 4	46.228.164.11 46.228.164.11	56396 (AMOBEE) (AMOBEE)
1	2a02:fa8:8806... 2a02:fa8:8806:13::1400	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1 3	2606:4700::68... 2606:4700::6812:19ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	35.204.74.118 35.204.74.118	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	3.126.125.13 3.126.125.13	16509 (AMAZON-02) (AMAZON-02)
5 5	37.157.6.243 37.157.6.243	198622 (ADFORM) (ADFORM)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
4	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1 2	2620:116:800d... 2620:116:800d:21:7eb1:3826:be7e:d981	16509 (AMAZON-02) (AMAZON-02)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
1 1	51.75.86.98 51.75.86.98	16276 (OVH) (OVH)
1 2	23.43.61.33 23.43.61.33	16625 (AKAMAI-AS) (AKAMAI-AS)
1 3	142.250.186.38 142.250.186.38	15169 (GOOGLE) (GOOGLE)
4	178.63.52.121 178.63.52.121	24940 (HETZNER-AS) (HETZNER-AS)
1 4	138.201.63.116 138.201.63.116	24940 (HETZNER-AS) (HETZNER-AS)
3 4	145.239.193.130 145.239.193.130	16276 (OVH) (OVH)
3	88.198.250.30 88.198.250.30	24940 (HETZNER-AS) (HETZNER-AS)
1	35.157.49.61 35.157.49.61	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1 1	2a05:d018:d29... 2a05:d018:d29:3602:15eb:19d4:d59:9b24	16509 (AMAZON-02) (AMAZON-02)
1	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c03::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400e:811::2003	15169 (GOOGLE) (GOOGLE)
206	39

2 107.178.241.59 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 59.241.178.107.bc.googleusercontent.com

www.balatarin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.84.174.27 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-174-27.cdg50.r.cloudfront.net

assets.balatarin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 52.217.17.238 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

img.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.166.41 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-166-41.cdg52.r.cloudfront.net

z-na.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ec2a47f34a564aae26f22e5e536bf217.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:808::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 142.250.186.34 (United States) 12 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 172.64.151.101 (United States) 5 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.89.210.212 (Frankfurt am Main, Germany) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 46.228.164.11 (United Kingdom) 2 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:13::1400 (Singapore)

ASN41041 (VCLK-EU-SE, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:19ad (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.204.74.118 (Groningen, Netherlands) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 118.74.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.125.13 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-125-13.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 37.157.6.243 (Denmark) 5 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

ius.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:7eb1:3826:be7e:d981 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.75.86.98 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ip98.ip-51-75-86.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.43.61.33 (Düsseldorf, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-43-61-33.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.38 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.63.52.121 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.121.52.63.178.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.116 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.116.63.201.138.clients.your-server.de

hal90004.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 145.239.193.130 (France) 3 redirects

ASN16276 (OVH, FR)

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 88.198.250.30 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.88-198-250-30.clients.your-server.de

pb.media01.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.157.49.61 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-49-61.eu-central-1.compute.amazonaws.com

t23.intelliad.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3602:15eb:19d4:d59:9b24 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c03::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400e:811::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
55	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 97 ec2a47f34a564aae26f22e5e536bf217.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 149	538 KB
51	doubleclick.net 13 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 cm.g.doubleclick.net — Cisco Umbrella Rank: 245 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 439 ad.doubleclick.net — Cisco Umbrella Rank: 154 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 154836 stats.g.doubleclick.net — Cisco Umbrella Rank: 78	323 KB
37	amazonaws.com s3.amazonaws.com	223 KB
18	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 300	685 KB
11	casalemedia.com 5 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 625	7 KB
9	balatarin.com www.balatarin.com — Cisco Umbrella Rank: 703211 assets.balatarin.com	226 KB
8	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 38186 hal90004.redintelligence.net — Cisco Umbrella Rank: 285160	53 KB
8	adnxs.com 5 redirects ib.adnxs.com — Cisco Umbrella Rank: 246	6 KB
6	google.com www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 105 region1.analytics.google.com — Cisco Umbrella Rank: 3040	1 KB
5	adform.net 5 redirects c1.adform.net — Cisco Umbrella Rank: 599	4 KB
4	medialead.de 3 redirects pv.medialead.de — Cisco Umbrella Rank: 44040	3 KB
4	turn.com 2 redirects ad.turn.com — Cisco Umbrella Rank: 851 r.turn.com — Cisco Umbrella Rank: 4121	2 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 212	238 KB
3	media01.eu pb.media01.eu — Cisco Umbrella Rank: 74479	964 B
3	tribalfusion.com 1 redirects a.tribalfusion.com — Cisco Umbrella Rank: 860 s.tribalfusion.com — Cisco Umbrella Rank: 2311	2 KB
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1403	494 B
2	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 764	797 B
2	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 351	291 B
2	simpli.fi 2 redirects um.simpli.fi — Cisco Umbrella Rank: 795	1 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 364 fonts.googleapis.com — Cisco Umbrella Rank: 31	35 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6862	408 B
1	criteo.com dis.criteo.com — Cisco Umbrella Rank: 597	363 B
1	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 492	714 B
1	intelliad.de t23.intelliad.de — Cisco Umbrella Rank: 143572	559 B
1	onetag-sys.com 1 redirects onetag-sys.com — Cisco Umbrella Rank: 746	443 B
1	travelaudience.com 1 redirects ads.travelaudience.com — Cisco Umbrella Rank: 5683	597 B
1	ctnsnet.com 1 redirects ius.ctnsnet.com — Cisco Umbrella Rank: 6637	625 B
1	dotomi.com dclk-match.dotomi.com — Cisco Umbrella Rank: 3451	104 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1181	554 B
1	amazon-adsystem.com z-na.amazon-adsystem.com — Cisco Umbrella Rank: 9559	8 KB
1	youtube.com img.youtube.com — Cisco Umbrella Rank: 3752	3 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	86 KB
0	gemius.pl Failed googlecm.hit.gemius.pl Failed
206	33

	Domain	Requested by
37	s3.amazonaws.com	www.balatarin.com
34	pagead2.googlesyndication.com	www.balatarin.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net securepubads.g.doubleclick.net www.googletagservices.com
28	cm.g.doubleclick.net	12 redirects googleads.g.doubleclick.net
20	tpc.googlesyndication.com	securepubads.g.doubleclick.net googleads.g.doubleclick.net www.balatarin.com tpc.googlesyndication.com s0.2mdn.net
18	s0.2mdn.net	www.balatarin.com s0.2mdn.net
11	dsum-sec.casalemedia.com	5 redirects googleads.g.doubleclick.net
10	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
8	ib.adnxs.com	5 redirects googleads.g.doubleclick.net
7	assets.balatarin.com	www.balatarin.com assets.balatarin.com
5	c1.adform.net	5 redirects
5	securepubads.g.doubleclick.net	www.balatarin.com securepubads.g.doubleclick.net www.googletagservices.com
4	pv.medialead.de	3 redirects hal90004.redintelligence.net
4	hal90004.redintelligence.net	1 redirects googleads.g.doubleclick.net hal90004.redintelligence.net
4	hal9000.redintelligence.net	googleads.g.doubleclick.net hal90004.redintelligence.net
4	googleads4.g.doubleclick.net	www.balatarin.com
4	www.google.com	googleads.g.doubleclick.net tpc.googlesyndication.com
4	www.googletagservices.com	securepubads.g.doubleclick.net googleads.g.doubleclick.net
3	pb.media01.eu	hal90004.redintelligence.net googleads.g.doubleclick.net
2	5994599.fls.doubleclick.net	1 redirects googleads.g.doubleclick.net
2	sync.teads.tv	1 redirects googleads.g.doubleclick.net
2	cms.quantserve.com	1 redirects googleads.g.doubleclick.net
2	x.bidswitch.net	googleads.g.doubleclick.net
2	um.simpli.fi	2 redirects
2	a.tribalfusion.com	1 redirects googleads.g.doubleclick.net
2	r.turn.com	www.balatarin.com
2	ad.turn.com	2 redirects
2	www.balatarin.com	ajax.googleapis.com
1	www.google.de	www.balatarin.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	region1.analytics.google.com	www.googletagmanager.com
1	adservice.google.com	5994599.fls.doubleclick.net
1	dis.criteo.com	googleads.g.doubleclick.net
1	pr-bh.ybp.yahoo.com	1 redirects
1	fonts.googleapis.com	hal90004.redintelligence.net
1	t23.intelliad.de	hal90004.redintelligence.net
1	ad.doubleclick.net	googleads.g.doubleclick.net
1	onetag-sys.com	1 redirects
1	ads.travelaudience.com	1 redirects
1	ius.ctnsnet.com	1 redirects
1	s.tribalfusion.com	googleads.g.doubleclick.net
1	dclk-match.dotomi.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	ec2a47f34a564aae26f22e5e536bf217.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	z-na.amazon-adsystem.com	www.balatarin.com
1	img.youtube.com	www.balatarin.com
1	ajax.googleapis.com	www.balatarin.com
1	www.googletagmanager.com	www.balatarin.com
0	googlecm.hit.gemius.pl Failed	googleads.g.doubleclick.net
206	48

This site contains links to these domains. Also see Links.

Domain
faradeed.ir
tabnakjavan.com
www.iranintl.com
parsi.euronews.com
iroon.com
www.radiozamaneh.com
www.radiofarda.com
www.asriran.com
play.google.com
ir.voanews.com
www.jamaran.news
www.rfi.fr
www.youtube.com
www.khabaronline.ir
seemorgh.com
stockholmian.com
help.balatarin.com
www.balavision.com
www.facebook.com
twitter.com

Subject Issuer	Validity	Valid
www.balatarin.com R3	`2023-10-22` - `2024-01-20`	3 months	crt.sh
*.balatarin.com Amazon RSA 2048 M02	`2023-06-01` - `2024-06-29`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2023-10-10` - `2024-07-10`	9 months	crt.sh
*.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
z-na.amazon-adsystem.com Amazon RSA 2048 M01	`2023-01-18` - `2024-02-17`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2023-08-15` - `2024-09-15`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2023-03-23` - `2024-03-23`	a year	crt.sh
quantserve.com R3	`2023-10-28` - `2024-01-26`	3 months	crt.sh
redintelligence.net R3	`2023-10-10` - `2024-01-08`	3 months	crt.sh
*.media01.eu RapidSSL TLS RSA CA G1	`2023-05-16` - `2024-05-15`	a year	crt.sh
pv.medialead.de R3	`2023-10-12` - `2024-01-10`	3 months	crt.sh
*.intelliad.de Thawte TLS RSA CA G1	`2023-07-31` - `2024-08-30`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-07` - `2024-05-06`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2023-12-23`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh

This page contains 31 frames:

Primary Page: https://www.balatarin.com/
Frame ID: EE82BDEA1B6A44507870D3F274A8DE59
Requests: 63 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231101/r20190131/zrt_lookup.html
Frame ID: 45EDB86ECDE5735C4E64DEFE78FD6C26
Requests: 1 HTTP requests in this frame

Frame: https://ec2a47f34a564aae26f22e5e536bf217.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 00A7BAD65790B98FEA8CDF690C124EFD
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvlY1Xu3AvW8LtPq0x8uzvcIoM20aiBvBrx_lx_Xck-pSTbHYI0dozQaG_RBRoIqahsSGpJp_Ek_OKfvCg3Dlk3NndRfysVGmjMprCL20mR__63e-hgm7_uZ-nR5xuE8_iQQZ9_avknm_d6__8iyK1chscW4E7E7nwbjVNy1WZnz7h2T2D6ST6KHzX_aE8SZx96OodY4e6bMejyZm-eqUva85jCHvvKZ9Gjp9hCfvo5LnVZOgBxAPcvhvDX1zBpd-bpWFbNyfN4ujQgCVPvfUFiaeUtfmJ8-5IEP1_0aoISDs-24mlIsrOiBgE6WQ5oYmxwQpb2ma5umQ&sai=AMfl-YTxQBLFdqQPpu0eHprZaYsKiCExTurq4x68jF_y6pSHNDj46OW-EdvPkb4tbJGWS-4GnuMTKgGJ7x7_di--sBr0KLNowckm7RSLrictA6pnyKasUKK9XdblaAdsEJOXFuNoOHJz5pcrjhXbBkk&sig=Cg0ArKJSzEKgUIX2CKPjEAE&uach_m=[UACH]&adurl=
Frame ID: 953E59CFF716DB5A270FA7CC9B874E4A
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&adk=1812271804&adf=3025194257&lmt=1699037883&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x945_l%7C212x945_r&format=0x0&url=https%3A%2F%2Fwww.balatarin.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882786&bpp=5&bdt=353&idt=242&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&nras=1&correlator=225557828045&frm=20&pv=2&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=266
Frame ID: 3756A38984668A0CB66E09FCE259CE17
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272
Frame ID: 3BF001067F1FBF0DE1A1F18738B38B77
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=5688324856&adk=4223602507&adf=1525804284&pi=t.ma~as.5688324856&w=336&fwrn=4&lmt=1699037883&rafmt=12&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&efwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882793&bpp=1&bdt=359&idt=314&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=243&ady=200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&xpc=RSslOf47GR&p=https%3A//www.balatarin.com&dtd=317
Frame ID: 8D113F1DC4BD993B3A251274D4217E8F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=8352827426&adk=3914965158&adf=2248382236&pi=t.ma~as.8352827426&w=336&fwrn=4&fwrnh=100&lmt=1699037883&rafmt=1&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882794&bpp=1&bdt=361&idt=319&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90%2C336x280&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=254&ady=1018&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&xpc=gkPueaxurS&p=https%3A//www.balatarin.com&dtd=321
Frame ID: 0D2F04B951C1465846087025D079D6AC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&adk=2481526797&adf=47773877&pi=t.aa~a.2729612806~rp.1&w=358&fwrn=4&fwrnh=100&lmt=1699037883&rafmt=1&to=qs&pwprc=6379213746&format=358x280&url=https%3A%2F%2Fwww.balatarin.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037883436&bpp=1&bdt=1003&idt=1&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8-22aadafc25e30044%3AT%3D1699037882%3ART%3D1699037883%3AS%3DALNI_MYFrSs6Yo02OrnvEr1O2QqdTUvFHw&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90%2C336x280%2C336x280&nras=2&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=231&ady=2082&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=2&fsb=1&xpc=lUMP9Vb187&p=https%3A//www.balatarin.com&dtd=6
Frame ID: A12100ADDD92A8CE89576AE959ADBB61
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUW_nt5Ep4vOXqTxKuq0SnL7Q3NcM3dET13uYIajofivuOVgLAD4DPwF9XBzplYb8r7xO9FcEH_rVu424dCGkg4gUg_ypKGwBya2dfVUERbdlSFujVuC9Or6Vr6y_hhoRCL8prQkvZGbbplTMpc-p82NptimQjasl3-DPFUYodnfwqyDVk
Frame ID: 774F8E5ADF8D8F2DEA36EAE89DFFEEDC
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: D072806BADEC810708442437F052180B
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXlDqsbTjrnSm99tkN4jb_WMkDmRR_TRq7Ak5w8UCe8ALb01vDZohNEf7JJs9MchXb2dKpUpZT57v6NvxtZceBj1JIQPhD-eqlt3g0uPIdFXIOMzfLUtrGg0pF-V1qmUGPDw4aU5kI_m3brp7zN4JI1Z_-on1xdTZBHgP5qlHA1WN2XjT4
Frame ID: BFA82C55FE214C42402E92A8D0366D80
Requests: 5 HTTP requests in this frame

Frame: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Frame ID: 19A57977C1306B1B3D872BE9AAAF4153
Requests: 13 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: BAA1399FEC2758765C24099285A1ACAA
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXYPb_sOKSACRhHLm0JjsYxcLTjksKi1Nm0aYe57d0USm_hiUc7Z9ewoERlVSJDShMWzrsr_vnfDnqsscLGJ2znzc52GJsr_3eaRBjaFB9GbQv4MWRkVWntpDIVPlJst1J0nUfc35W9nP1ZyQ3MU_0YqplhcXwkT3M-S8PoOMKg9XOkC_s
Frame ID: 93E990969D41094D70A7AF81229C9658
Requests: 5 HTTP requests in this frame

Frame: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Frame ID: 2744C9AE9CCC6206A4E895C1D6AF0AD9
Requests: 13 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 5327FFE0F778A28E1B1DA460DE5BF6E3
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: A2D8799AD36D66D46D934986946A1DC2
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250
Frame ID: 080D5177C93B11286E77DB165EDD39D6
Requests: 11 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250
Frame ID: 08F90E9374BE494AF37197B8CD1EFF54
Requests: 11 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: C2D31DCC6AC3D23314D587F11EC60B70
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 281CC1D59ACC8E4E08FFF1437E0E07C4
Requests: 3 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=31604400131990004444550012497004&actionid=879111&produktid=ratenkredit&dt_url=
Frame ID: B0DBA55B4D21E83D5B56A982EBDF5A1D
Requests: 1 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654542bce7e41c365b30feb2&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=
Frame ID: FAD12745351AB0E90FB075E645852C25
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js
Frame ID: BF065A91C36B052C7299B4D291110C92
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js
Frame ID: CCE09DAF4CD6C55571176F83B572872B
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNS2t6zBqIIDFZXMOwIdfJsD0Q;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658
Frame ID: 3299851160E9AA78DE1546462B215659
Requests: 2 HTTP requests in this frame

Frame: https://hal90004.redintelligence.net/request_content.php?s=31604400131990004444550012497004&a=20ed013d
Frame ID: 2D1114586534B2D280CDC739C8D0B398
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: D636A8CEC08CC409787BDF09D569F38E
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 35F7C9E884CE9D6AF5D50692CBECB7BA
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4E8CE3C4AFD3F534EEC36B7012D591F2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

بالاترین: لینک‌های منتخب

Page URL History Show full URLs

http://www.balatarin.com/ HTTP 307
https://www.balatarin.com/ Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

206
Requests

86 %
HTTPS

48 %
IPv6

33
Domains

48
Subdomains

39
IPs

9
Countries

2424 kB
Transfer

5699 kB
Size

30
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: https://faradeed.ir/%D8%A8%D8%AE%D8%B4-%D8%AD%DB%8C%D8%A7%D8%AA-%D9%88%D8%AD%D8%B4-101/159563-%D8%B9%DA%A9%D8%B3-%D9%85%D8%A7%D8%B1-%D9%81%D9%84%DA%A9-%D8%B2%D8%AF%D9%87-%D9%85%D9%88%D8%B4-%D8%AA%D9%84%D9%87-%D9%85%D9%88%D8%B4-%D8%B1%D8%A7-%D8%A8%D8%A7-%D9%87%D9%85-%D9%82%D9%88%D8%B1%D8%AA-%D8%AF%D8%A7%D8%AF
Title: (عکس) مار فلک‌زده موش و تله‌موش را با هم قورت داد!

Search URL Search Domain Scan URL

URL: https://tabnakjavan.com/fa/news/69750/%D8%A7%D9%86%D8%AA%D9%82%D8%A7%D8%AF-%DB%8C%DA%A9-%D9%BE%D8%B2%D8%B4%DA%A9-%D8%A7%D8%B2-%D8%A7%DB%8C%D9%86-%D8%B3%DA%A9%D8%A7%D9%86%D8%B3-%D8%B2%D8%AE%D9%85-%DA%A9%D8%A7%D8%B1%DB%8C-%D9%81%DB%8C%D9%84%D9%85
Title: انتقاد یک پزشک از این سکانس زخم کاری + فیلم

Search URL Search Domain Scan URL

URL: https://www.iranintl.com/202311028531
Title: ساکت، استاندار، امام جمعه یا بیت رهبری؛ چه کسی عامل اصلی جریمه سنگین سپاهان است؟

Search URL Search Domain Scan URL

URL: https://parsi.euronews.com/2023/11/01/afc-announced-sepahan-lost-3-0-against-al-ittihad
Title: رسانه‌های ایران از «حکم بی‌سابقه» کنفدراسیون فوتبال آسیا علیه سپاهان خبر دادند

Search URL Search Domain Scan URL

URL: https://iroon.com/irtn/cartoon/9272/iran-hand-on-the-trigger/
Title: کاریکاتور: انگشت روی ماشه

Search URL Search Domain Scan URL

URL: https://parsi.euronews.com/2023/11/01/saudi-arabia-set-to-host-2034-fifa-world-cup-after-submitting-sole-bid
Title: حواشی احتمال اعطای میزبانی جام جهانی به عربستان؛ دیده‌بان حقوق بشر خواستار تجدیدنظر فیفا شد

Search URL Search Domain Scan URL

URL: https://www.radiozamaneh.com/787347
Title: چالش‌های تبعیض اتنیکی در ایران؛ بررسی ساختار دموکراسی در نروژ

Search URL Search Domain Scan URL

URL: https://www.radiofarda.com/a/32665029.html
Title: آمریکا بازداشت فعالان مدنی را در مراسم خاکسپاری آرمیتا گراوند محکوم کرد

Search URL Search Domain Scan URL

URL: https://www.asriran.com/fa/news/914521/%D9%BE%D9%84%D9%85%D8%A8-%DB%B5-%DA%A9%D8%A7%D9%81%D9%87-%D8%B1%D8%B3%D8%AA%D9%88%D8%B1%D8%A7%D9%86-%D8%B4%DB%8C%D8%B1%D8%A7%D8%B2-%D8%A8%D8%AE%D8%A7%D8%B7%D8%B1-%D8%A8%D8%B1%DA%AF%D8%B2%D8%A7%D8%B1%DB%8C-%D8%AC%D8%B4%D9%86-%D9%87%D8%A7%D9%84%D9%88%D9%88%DB%8C%D9%86
Title: پلمب ۵ کافه رستوران شیراز بخاطر برگزاری جشن هالووین

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.balatarin.android.app&referrer=utm_source%3Dbalablog
Title: اپ بالاترین برای اندروید

Search URL Search Domain Scan URL

URL: https://ir.voanews.com/a/iran-aghajari-petrolium-workers-protest/7336997.html
Title: تداوم اعتراضات کارکنان رسمی شرکت نفت و گاز آغاجاری

Search URL Search Domain Scan URL

URL: https://www.jamaran.news/%D8%A8%D8%AE%D8%B4-%D8%AC%DB%8C-%D9%BE%D9%84%D8%A7%D8%B3-70/1612839-%D8%AA%D8%B1%D9%81%D9%86%D8%AF%D9%87%D8%A7%DB%8C-%D9%81%D9%88%D9%82-%D8%A7%D9%84%D8%B9%D8%A7%D8%AF%D9%87-%D8%B4%D8%AF%D9%86-%D8%B7%D8%B9%D9%85-%D8%B3%D8%A7%D9%84%D8%A7%D8%AF-%D8%A7%D9%84%D9%88%DB%8C%D9%87
Title: ترفندهای فوق العاده شدن طعم سالاد الویه

Search URL Search Domain Scan URL

URL: https://www.rfi.fr/fa/%D8%A7%D9%81%D8%BA%D8%A7%D9%86%D8%B3%D8%AA%D8%A7%D9%86/20231101-%D8%B7%D8%A7%D9%84%D8%A8%D8%A7%D9%86-%D8%AF%D8%B1-%DB%B2%DB%B4-%D8%B3%D8%A7%D8%B9%D8%AA-%D9%BE%D8%B3%DB%8C%D9%86-%DB%B1%DB%B2-%D9%87%D8%B2%D8%A7%D8%B1-%D9%85%D9%87%D8%A7%D8%AC%D8%B1-%D8%A7%D8%B2-%D9%BE%D8%A7%DA%A9%D8%B3%D8%AA%D8%A7%D9%86-%D8%A8%D9%87-%D8%A7%D9%81%D8%BA%D8%A7%D9%86%D8%B3%D8%AA%D8%A7%D9%86-%D8%A8%D8%A7%D8%B2%DA%AF%D8%B4%D8%AA%D9%87-%D8%A7%D9%86%D8%AF
Title: اخراج دسته‌جمعی مهاجران از پاکستان: طالبان می‌گویند در ۲۴ ساعت پسین ۱۲ هزار مهاجر از پاکستان به افغانستان بازگشته‌اند

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=Phulfb6IoSk
Title: صحبت های یک ‏بلاگر عربستانی که بر اساس قرآن برای فلسطینی‌ها صحبت کرده

Search URL Search Domain Scan URL

URL: https://ir.voanews.com/a/deepfake-video-impersonates-voa-russian-service-anchor-underscoring-ai-concerns/7334695.html
Title: انتشار ویدیوی جعلی مجری صدای آمریکا خبرساز شد؛ افزایش نگرانی‌ها از گسترش کاربرد هوش مصنوعی

Search URL Search Domain Scan URL

URL: https://www.khabaronline.ir/news/1831857/%D8%AA%D8%A7%D9%84%D8%A7%D8%B1-%D9%87%D9%85-%D9%BE%D9%84%D9%85%D8%A8-%D8%B4%D8%AF-%D9%BE%D8%B3-%D9%84%D8%B1%D8%B2%D9%87-%D9%87%D8%A7%DB%8C-%D8%A8%DB%8C-%D8%AD%D8%AC%D8%A7%D8%A8%DB%8C-%D9%BE%D8%B2%D8%B4%DA%A9-%D8%A2%D9%85%D9%84%DB%8C-%D8%A7%D8%AF%D8%A7%D9%85%D9%87-%D8%AF%D8%A7%D8%B1%D8%AF
Title: تالار هم پلمب شد؛ پس‌لرزه‌های بی‌حجابی پزشک آملی ادامه دارد/ جزئیات

Search URL Search Domain Scan URL

URL: https://seemorgh.com/news/incident/478178-%D9%86%D9%82%D8%B4%D9%87-%DA%A9%D8%AB%DB%8C%D9%81-%D8%B2%D9%86-%D8%AA%D8%A8%D9%87%DA%A9%D8%A7%D8%B1-%D8%A8%D8%B1%D8%A7%DB%8C-%D8%A7%D9%86%D8%AA%D9%82%D8%A7%D9%85-%D8%A7%D8%B2-%D9%85%D8%B1%D8%AF%D8%A7%D9%86/
Title: نقشه کثیف زن تبهکار برای انتقام از مردان

Search URL Search Domain Scan URL

URL: https://stockholmian.com/news/persiska/2023/604.htm
Title: پیامدهای غیر منتظره و جدی برای افراد موجود در فهرست خریداران کوکائین

Search URL Search Domain Scan URL

URL: https://help.balatarin.com/
Title: راهنما

Search URL Search Domain Scan URL

URL: https://help.balatarin.com/home/advertising
Title: آگهی

Search URL Search Domain Scan URL

URL: https://www.balavision.com/
Title: بالاویزیون

Search URL Search Domain Scan URL

URL: https://help.balatarin.com/about
Title: About

Search URL Search Domain Scan URL

URL: https://www.facebook.com/balatarin

Search URL Search Domain Scan URL

URL: https://twitter.com/balatarin

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.balatarin.com/ HTTP 307
https://www.balatarin.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 88

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

Request Chain 89

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUVCu5HZvqm8cQ5tSTXXTgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

Request Chain 90

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1

Request Chain 91

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D

Request Chain 92

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

Request Chain 93

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUVCu5HZvqm8cQ5tSTXXTgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

Request Chain 94

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1

Request Chain 95

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D

Request Chain 111

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1&google_push=AXcoOmRX_bglT8Hy8uF8xhrILrrVSTgOt88dsWgEzV6LW8fajV989Llt5cqxuPraCNdewbnQ1v53CqrTBHNP5SlYiD87xC1xTArDifw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODU3MzI5MTgzODEyMzUxODkzOQ==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1

Request Chain 113

https://a.tribalfusion.com/i.match?p=b6&u=CAESEErABbT47IFkkg41oFSJi84&google_cver=1&google_push=AXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq9OwA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq9OwA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEErABbT47IFkkg41oFSJi84&google_cver=1&google_push=AXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq9OwA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq9OwA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 114

https://um.simpli.fi/gp_match?google_gid=CAESEAH5JD5D5Pz8eaW_mBNnb5U&google_cver=1&google_push=AXcoOmSzEA-jsHbputFkI8TdS-151QoQJSIr68Z5AdUScwGoKxJxdUe4YoYXtYsGPJ-ogQNOx_sEqXnElKapAJKwBLL2skcQe4_ViA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6DB76898629746AD8BFB9AE2347F9B67&google_push=AXcoOmSzEA-jsHbputFkI8TdS-151QoQJSIr68Z5AdUScwGoKxJxdUe4YoYXtYsGPJ-ogQNOx_sEqXnElKapAJKwBLL2skcQe4_ViA

Request Chain 116

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmTqpBGs_e4VRYTMR2sb9tM8xJ_v9Ax10jWkvWK3L7lxJY_n7ejMgSEqUJm_ZXCzPzU7bVDExX0jzWHBFOb_XZmF604D8tbVV38 HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmTqpBGs_e4VRYTMR2sb9tM8xJ_v9Ax10jWkvWK3L7lxJY_n7ejMgSEqUJm_ZXCzPzU7bVDExX0jzWHBFOb_XZmF604D8tbVV38 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODE5MTI1MTgzNDE0NzY5Mjk0Ng&google_push=AXcoOmTqpBGs_e4VRYTMR2sb9tM8xJ_v9Ax10jWkvWK3L7lxJY_n7ejMgSEqUJm_ZXCzPzU7bVDExX0jzWHBFOb_XZmF604D8tbVV38

Request Chain 117

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESENMNKuGT5MRjMZ1ins-XRvE&google_cver=1&google_push=AXcoOmQs_QhiT7o2JbVhQcM0hYQiK-mvHvNx_FVaRVDGCA54DhIUrdQZH7msv4EPRiNPk5rJmHuLWEvNTIRnY9N3lczCM2L2EixzD0lD HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQs_QhiT7o2JbVhQcM0hYQiK-mvHvNx_FVaRVDGCA54DhIUrdQZH7msv4EPRiNPk5rJmHuLWEvNTIRnY9N3lczCM2L2EixzD0lD&google_hm=zNwqWMetSb2JPYHDvN4i74U

Request Chain 120

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

Request Chain 121

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUVCu5HZvqm8cQ5tSTXXTgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

Request Chain 122

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1

Request Chain 123

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D

Request Chain 126

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1&google_push=AXcoOmRJxMzhcLnSCheBninu09Jsxfp60zVt6tCwcx4f4wh81rTviiR7ANWuKX0Sip_GzF5VN0pYNt7n3AiAh_DtlMV9l3PsqTCrVYLl-ZYb_tGKgX8azZG2WI-w9peZsV6bhPPjzjtCxuv19t74E7hS2LkJqOA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjM3NzE4MzE3NTc5MTg0ODQxMQ==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1

Request Chain 128

https://um.simpli.fi/gp_match?google_gid=CAESEAH5JD5D5Pz8eaW_mBNnb5U&google_cver=1&google_push=AXcoOmR_CZa64zdqD1SRAOHLY43hoMYbyzbJkLXqUHwt_KgpI52q-HCmmNB-cY0aq2z-_JSXpsPRX5W7wn4X-L7UN_vqpWtE5PPCET6d4EEWLBZk2nSx-2hvBG54crt7p_1IAQCrU7uqnAgofzjV0Bp4_Dt0E08 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6DB76898629746AD8BFB9AE2347F9B67&google_push=AXcoOmR_CZa64zdqD1SRAOHLY43hoMYbyzbJkLXqUHwt_KgpI52q-HCmmNB-cY0aq2z-_JSXpsPRX5W7wn4X-L7UN_vqpWtE5PPCET6d4EEWLBZk2nSx-2hvBG54crt7p_1IAQCrU7uqnAgofzjV0Bp4_Dt0E08

Request Chain 129

https://ads.travelaudience.com/google_pixel?google_gid=CAESEGf3p27gjoCvTQtJygeaqzs&google_cver=1&google_push=AXcoOmT2PPJ_27edLLBj9Q8QOe3afQY_WikH4xbc7sHbIsD7yId9EYejUIB65A6NN8rCOZLMU_36x62nwJjMr_eQnW5xWhzRK6qCy5ofkYjYQxgRBzAXH0LpopHhGxjOomntnB13998ze--FsTxqlpt1KJ6qpUA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4svS1iKmRd4mgAzZ1W9h7w&google_push=AXcoOmT2PPJ_27edLLBj9Q8QOe3afQY_WikH4xbc7sHbIsD7yId9EYejUIB65A6NN8rCOZLMU_36x62nwJjMr_eQnW5xWhzRK6qCy5ofkYjYQxgRBzAXH0LpopHhGxjOomntnB13998ze--FsTxqlpt1KJ6qpUA

Request Chain 130

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmSFVG4xf-vz_IPNPI2yywlPcKtw_rzim9j0bxYww5TqmJjt4-b1Bp7C4Ntv2zne9cPjJ_rN2ivS_zHE0hxVGFlP9bsHftKs1_4rYDwyjDyGF6HqWwVHPMeRR-_3xsRSkM_eVbf5O9v20tKPZW42DMfMPoY HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmSFVG4xf-vz_IPNPI2yywlPcKtw_rzim9j0bxYww5TqmJjt4-b1Bp7C4Ntv2zne9cPjJ_rN2ivS_zHE0hxVGFlP9bsHftKs1_4rYDwyjDyGF6HqWwVHPMeRR-_3xsRSkM_eVbf5O9v20tKPZW42DMfMPoY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Nzc1NTY5OTczMzczMjEyOTI3Mg&google_push=AXcoOmSFVG4xf-vz_IPNPI2yywlPcKtw_rzim9j0bxYww5TqmJjt4-b1Bp7C4Ntv2zne9cPjJ_rN2ivS_zHE0hxVGFlP9bsHftKs1_4rYDwyjDyGF6HqWwVHPMeRR-_3xsRSkM_eVbf5O9v20tKPZW42DMfMPoY

Request Chain 131

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEJFEson5bb-cckY1MYVXtI0&google_cver=1&google_push=AXcoOmRq6RwHRmrbLFFnbRaTz2Ikk0MAVuqrQrUKyMUE60Ha7a74pa-SFcRNTHTJ5H0ySelsvf45q2xHceo4l1uOMBw1eAK-wl4rHXXxUpuAEgaeTaq3OdLVECVml2ABRzxEHa7TbPZEedck1hsyu8frkCqOJg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRq6RwHRmrbLFFnbRaTz2Ikk0MAVuqrQrUKyMUE60Ha7a74pa-SFcRNTHTJ5H0ySelsvf45q2xHceo4l1uOMBw1eAK-wl4rHXXxUpuAEgaeTaq3OdLVECVml2ABRzxEHa7TbPZEedck1hsyu8frkCqOJg

Request Chain 132

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEOtN6WeAPhcTkpNysLZrUnQ&google_cver=1&google_push=AXcoOmRf0I3fUHxxifvtvi1lxq7A2fI3mobdy4P_B1Zr8O0h41Pkwu88IolI58Uh2Zk7K2SMJfdTjnJa3mxCmNEe-sYEgCq1asQbpJkA9vxqL0E8LI1wK2aoYChq5NgwAleHQ8MC8IzLw9u37C4ZkOQiWfDtHB-t HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmRf0I3fUHxxifvtvi1lxq7A2fI3mobdy4P_B1Zr8O0h41Pkwu88IolI58Uh2Zk7K2SMJfdTjnJa3mxCmNEe-sYEgCq1asQbpJkA9vxqL0E8LI1wK2aoYChq5NgwAleHQ8MC8IzLw9u37C4ZkOQiWfDtHB-t HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 145

https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6dba62b22e&subid=&uid=699d568a6d2778e8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAL-Lu0JFZaODD9KumtUPv-QppuW9oGmFlZynyQ_wLhABIIjO5BFgleKQgqAHyAEJqQKP2hbrhNyxPqgDAcgDmwSqBKECT9BWG07Q6ZIOKZeLkIiavhd157-G-kk_xy71xp3vfG3zyXpUAUeC0fQjTdFvSa6KXHAor54vevfofuX6C0bXcFYLb9OFyJ345ej2t5JKxRafDxYXKXRhj6tXj13XUvJKXFs2xC9ajDJsb97RYyQ73Uqe-6N-YWMiRfL7qI-VvVdSBi5e7PNAaYHESLObJEECi3vcFw9SmYkVvtBx8lyJdYKEvYp9ktLe_6BhLghKliuMT70B_lO4MBdo95C69IKp7uKtABnLOKvf1RqiIDUEYqeNQMpahQhuUXaIeOQ3QbkscTXcUP1v4g_uLvO-zTA38rAGAim3ysf1XqmIlouZ35AxY2Mnih6afZX_CKVoa0dCXOsqbUSjcfWShDIzHICyrsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNaD4rVKmG_yFKPiMOj8xnzaNmsNdlhquqkxrhHP7mbOw5vRcXvU3foJ9DxKr8-lgmd7droN5mGAE%26sig%3DAOD64_2LI_VVFVXM9iKmmMFK_C0zEQw9yQ%26client%3Dca-pub-7031645305449270%26dbm_c%3DAKAmf-A9l9y5h-Ug6uUPjy_F1rio32W5AO3FJmJuvkkLIewWF8oVtbT4ctdWlN9nwtAj_H0JS0I9vszvEouVlZfaZVGYoM1B08mzI6XTBQQT8OdIwhJbMU9zQhfM_IpAKJTrdPf25rqRhsB67ECT00r2Y9735b5lj_5Yzr7TgN5Y4X6wcYZdxkU%26cry%3D1%26dbm_d%3DAKAmf-AgoeOCClwj_P2E61ATD31bqvSw2FfQT37SxfEu7E2Bq-QkqrB_DL6ag2MwM57u6un1euK4c9HOeXXoFTQCeKeOu2g3Euo6eCtdueXB4DXue49sW3HWQLYBf2lo1lhzX8tAG7RxO2Ka3679fXPutNZAnprNNaMJyaP360YVeo5rqmYBPDSWasiBodgPCZoq1ysTnlI8XbQxyb2qLFQlq6ktn-1rTwDPu9EDLghEH4vRQaEFKbzJNghw8ebp1j61Pi1dtcV6miBdxn0E5hlTjomQg6cgIlcUrc23Zt-0Gl9y_cT3ybvnI8n4UV5qMu_iMDd7LATKRKddtExseZmdyGB0k85aYT4oWKG6G8lhBVGZsqR7PjvH8AxmRhc4FL6EtBp9iqMuOLo6gnEQXjbf6BaofxoNO638kNM4q2IHYv6asJcgKGo9IEVI4mv5ncIDG9HwUOO8bnaFAAaLGDWVhvh0MJBPs-mP982WYsGkrWk-3PjXS63fm41d2R5uxpyhSUmu3iGIe0QJ4KcNZ2mEx5hy1DiuykDOv6PXByjH4vOqn-9EevQ%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-7031645305449270%26output%3Dhtml%26h%3D90%26slotname%3D6838607656%26adk%3D1683087958%26adf%3D3570656667%26pi%3Dt.ma~as.6838607656%26w%3D779%26lmt%3D1699037883%26rafmt%3D12%26format%3D779x90%26url%3Dhttps%253A%252F%252Fwww.balatarin.com%252F%26hl%3Den%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1699037882791%26bpp%3D1%26bdt%3D358%26idt%3D268%26shv%3Dr20231101%26mjsv%3Dm202310310101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D1df45741068a73f8%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w%26gpic%3DUID%253D00000cb3a430dbd4%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D225557828045%26frm%3D20%26pv%3D1%26ga_vid%3D898914513.1699037883%26ga_sid%3D1699037883%26ga_hid%3D1670824771%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D605%26ady%3D1302%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079080%252C31079231%252C31079347%252C44785295%252C44795921%252C44807047%252C44807336%252C44807454%252C31078297%26oid%3D2%26pvsid%3D3561240333002577%26tmod%3D425826272%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Do%257Co%257CEebr%257C%26abl%3DNS%26pfx%3D0%26fu%3D256%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3DsJPmhRYXbv%26p%3Dhttps%253A%2F%2Fwww.balatarin.com%26dtd%3D272&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.balatarin.com&random=4440897818852&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6dba62b22e&subid=&uid=699d568a6d2778e8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAL-Lu0JFZaODD9KumtUPv-QppuW9oGmFlZynyQ_wLhABIIjO5BFgleKQgqAHyAEJqQKP2hbrhNyxPqgDAcgDmwSqBKECT9BWG07Q6ZIOKZeLkIiavhd157-G-kk_xy71xp3vfG3zyXpUAUeC0fQjTdFvSa6KXHAor54vevfofuX6C0bXcFYLb9OFyJ345ej2t5JKxRafDxYXKXRhj6tXj13XUvJKXFs2xC9ajDJsb97RYyQ73Uqe-6N-YWMiRfL7qI-VvVdSBi5e7PNAaYHESLObJEECi3vcFw9SmYkVvtBx8lyJdYKEvYp9ktLe_6BhLghKliuMT70B_lO4MBdo95C69IKp7uKtABnLOKvf1RqiIDUEYqeNQMpahQhuUXaIeOQ3QbkscTXcUP1v4g_uLvO-zTA38rAGAim3ysf1XqmIlouZ35AxY2Mnih6afZX_CKVoa0dCXOsqbUSjcfWShDIzHICyrsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNaD4rVKmG_yFKPiMOj8xnzaNmsNdlhquqkxrhHP7mbOw5vRcXvU3foJ9DxKr8-lgmd7droN5mGAE%26sig%3DAOD64_2LI_VVFVXM9iKmmMFK_C0zEQw9yQ%26client%3Dca-pub-7031645305449270%26dbm_c%3DAKAmf-A9l9y5h-Ug6uUPjy_F1rio32W5AO3FJmJuvkkLIewWF8oVtbT4ctdWlN9nwtAj_H0JS0I9vszvEouVlZfaZVGYoM1B08mzI6XTBQQT8OdIwhJbMU9zQhfM_IpAKJTrdPf25rqRhsB67ECT00r2Y9735b5lj_5Yzr7TgN5Y4X6wcYZdxkU%26cry%3D1%26dbm_d%3DAKAmf-AgoeOCClwj_P2E61ATD31bqvSw2FfQT37SxfEu7E2Bq-QkqrB_DL6ag2MwM57u6un1euK4c9HOeXXoFTQCeKeOu2g3Euo6eCtdueXB4DXue49sW3HWQLYBf2lo1lhzX8tAG7RxO2Ka3679fXPutNZAnprNNaMJyaP360YVeo5rqmYBPDSWasiBodgPCZoq1ysTnlI8XbQxyb2qLFQlq6ktn-1rTwDPu9EDLghEH4vRQaEFKbzJNghw8ebp1j61Pi1dtcV6miBdxn0E5hlTjomQg6cgIlcUrc23Zt-0Gl9y_cT3ybvnI8n4UV5qMu_iMDd7LATKRKddtExseZmdyGB0k85aYT4oWKG6G8lhBVGZsqR7PjvH8AxmRhc4FL6EtBp9iqMuOLo6gnEQXjbf6BaofxoNO638kNM4q2IHYv6asJcgKGo9IEVI4mv5ncIDG9HwUOO8bnaFAAaLGDWVhvh0MJBPs-mP982WYsGkrWk-3PjXS63fm41d2R5uxpyhSUmu3iGIe0QJ4KcNZ2mEx5hy1DiuykDOv6PXByjH4vOqn-9EevQ%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-7031645305449270%26output%3Dhtml%26h%3D90%26slotname%3D6838607656%26adk%3D1683087958%26adf%3D3570656667%26pi%3Dt.ma~as.6838607656%26w%3D779%26lmt%3D1699037883%26rafmt%3D12%26format%3D779x90%26url%3Dhttps%253A%252F%252Fwww.balatarin.com%252F%26hl%3Den%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1699037882791%26bpp%3D1%26bdt%3D358%26idt%3D268%26shv%3Dr20231101%26mjsv%3Dm202310310101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D1df45741068a73f8%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w%26gpic%3DUID%253D00000cb3a430dbd4%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D225557828045%26frm%3D20%26pv%3D1%26ga_vid%3D898914513.1699037883%26ga_sid%3D1699037883%26ga_hid%3D1670824771%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D605%26ady%3D1302%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079080%252C31079231%252C31079347%252C44785295%252C44795921%252C44807047%252C44807336%252C44807454%252C31078297%26oid%3D2%26pvsid%3D3561240333002577%26tmod%3D425826272%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Do%257Co%257CEebr%257C%26abl%3DNS%26pfx%3D0%26fu%3D256%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3DsJPmhRYXbv%26p%3Dhttps%253A%2F%2Fwww.balatarin.com%26dtd%3D272&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.balatarin.com&random=4440897818852&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 168

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=31604400131990004444550012497004&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=31604400131990004444550012497004&actionid=879111&produktid=ratenkredit&dt_url=

Request Chain 169

https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=31604400131990004444550012497004&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654542bce7e41c365b30feb2&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

Request Chain 170

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=31604400131990004444550012497004&t=htlp&gdpr=1&consent=1&gdpr_consent= HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=31604400131990004444550012497004&actionid=879111&produktid=ratenkredit&dt_url=

Request Chain 178

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CNS2t6zBqIIDFZXMOwIdfJsD0Q;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658

Request Chain 186

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESED6gyHFQK6nUTy64tItfrHM&google_cver=1&google_push=AXcoOmQLICjoZOMUBlnOJlcNz2eMQY3s4yICojeGb5Pfk6FBFyxsaIuzfkD5A2_0EYcjN9vkDPLGLmxVyk-i9Aq0JnEZv5vYEsN-CQ HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQLICjoZOMUBlnOJlcNz2eMQY3s4yICojeGb5Pfk6FBFyxsaIuzfkD5A2_0EYcjN9vkDPLGLmxVyk-i9Aq0JnEZv5vYEsN-CQ&google_hm=bAWoi5Y1aunU8CXKjp4Ljw

Request Chain 189

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEPre8vl7Rngmuw7dQKbh7DA&google_cver=1&google_push=AXcoOmRCPAzcLFe0UgosFZY3L-K1UqEDtfPUZSsunuvmdp287RYkiJyv1pINDu-J7lPpH4zi6fFiZ_wm8ipi-oTLzYb-oLtLOmRZWVs HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRCPAzcLFe0UgosFZY3L-K1UqEDtfPUZSsunuvmdp287RYkiJyv1pINDu-J7lPpH4zi6fFiZ_wm8ipi-oTLzYb-oLtLOmRZWVs&google_hm=eS1TTmRjTTZCRTJwRm0zcUk4V3hUTUV1T1Y3VlRhYXpPVn5B

Request Chain 191

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmS2yv52M097eoxFRov-NoQUrtKTe37pT8_LMnC15LfO-wpTGCKBL7IpbvyUsnE8JblC0MYAmqzPIf4DjUlh3sgXLyE6hSxHliY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODE5MTI1MTgzNDE0NzY5Mjk0Ng&google_push=AXcoOmS2yv52M097eoxFRov-NoQUrtKTe37pT8_LMnC15LfO-wpTGCKBL7IpbvyUsnE8JblC0MYAmqzPIf4DjUlh3sgXLyE6hSxHliY

206 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.balatarin.com/
Redirect Chain

http://www.balatarin.com/
https://www.balatarin.com/

112 KB
25 KB

256ms
233ms

Document
text/html

107.178.241.59
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.178.241.59 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

59.241.178.107.bc.googleusercontent.com

Software

nginx /

Resource Hash

74bafe634fa74d1022730eb10d68f83eaa23ed09243423e9e0b7b0712826a5c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 03 Nov 2023 18:58:02 GMT
etag: W/"74bafe634fa74d1022730eb10d68f83e"
link: <https://assets.balatarin.com/assets/application-d0159fb0201b0c9e4b83f04fcca5096874700cd28a080507859919da3bd431c5.css>; rel=preload; as=style; nopush,<https://assets.balatarin.com/assets/application-ad5cfdcee3dc7025ae2e47eb626092c3f8e69928ee6909ed8d83cf14f87a3dc2.js>; rel=preload; as=script; nopush
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=31556952; includeSubDomains; preload
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: c7af3635-6bbb-4eac-a6d4-7ac27a88baa7
x-runtime: 0.035885
x-xss-protection: 0

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://www.balatarin.com/
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK application-d0159fb0201b0c9e4b83f04fcca5096874700cd28a080507859919da3bd431c5.css
assets.balatarin.com/assets/ 256 KB
45 KB 106ms
21ms Stylesheet
text/css 52.84.174.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.balatarin.com/assets/application-d0159fb0201b0c9e4b83f04fcca5096874700cd28a080507859919da3bd431c5.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.174.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-174-27.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e6cdb7a81b23ab5cd13f0cdc9f0b6499db70b123160317b17c27d7acfa9e0ebf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sun, 01 Oct 2023 23:28:35 GMT
Content-Encoding: gzip
Via: 1.1 16de6e3636993b2d3f832b9ae653bd68.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: CDG50-P1
Age: 2834967
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Fri, 22 Sep 2023 13:53:11 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: md5:af092868d0bd16e0f3b96bfb0158d176
ETag: W/"af092868d0bd16e0f3b96bfb0158d176"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
X-Amz-Cf-Id: ErJo3pBEfvk7ep4igIeZITA3xiDYoRCjn6thwTafWxE2xqIbhQyWYg==

GET
H/1.1 200
OK application-ad5cfdcee3dc7025ae2e47eb626092c3f8e69928ee6909ed8d83cf14f87a3dc2.js Show response
assets.balatarin.com/assets/ 147 KB
41 KB 111ms
25ms Script
application/javascript 52.84.174.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.balatarin.com/assets/application-ad5cfdcee3dc7025ae2e47eb626092c3f8e69928ee6909ed8d83cf14f87a3dc2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.174.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-174-27.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ad5cfdcee3dc7025ae2e47eb626092c3f8e69928ee6909ed8d83cf14f87a3dc2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 13 Oct 2023 22:07:59 GMT
Content-Encoding: gzip
Via: 1.1 9c8fea304cc4dc64f018a09a43cea24a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: CDG50-P1
Age: 1803004
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Wed, 19 Jul 2023 14:37:42 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: md5:b53d22adffdbb8d3a164fafc980ff253
ETag: W/"b53d22adffdbb8d3a164fafc980ff253"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=31536000
X-Amz-Cf-Id: skpeRXX_S50YB1NztrdzbVXGvXr299VbF3RIh_H5cy5AzZUW0XAeWQ==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 248 KB
86 KB 47ms
17ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-8X79LBSGX3

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2be701f18dc8f0aebd70159d876b7dbe53770360ed7739abbf6b41a91d0773ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 87640
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 03 Nov 2023 18:58:02 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
52 KB 147ms
110ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e9292378c34069e5a89179aae753b399421de949e17bba27ef8c2d1336904ee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52313
x-xss-protection: 0
server: cafe
etag: 6737485099257066728
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 03 Nov 2023 18:58:02 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 98 KB
31 KB 114ms
90ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

493a4ee10da56f9c836699e31ab3234bd30e15205ee5c12a10d9f7eeafa21376

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30727
x-xss-protection: 0
server: cafe
etag: 67 / 19664 / m202310310101 / config-hash: 2467317071977311172
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 03 Nov 2023 18:58:02 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ 95 KB
34 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 10:20:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 290271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33951
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Oct 2024 10:20:11 GMT

GET
H/1.1 200
OK app-f3879cbf119d2a99d9badd2bff1fa3d39b35264fee9453ed22b49f3b7dc3ef8d.js Show response
assets.balatarin.com/assets/ 135 KB
35 KB 23ms
21ms Script
application/javascript 52.84.174.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.balatarin.com/assets/app-f3879cbf119d2a99d9badd2bff1fa3d39b35264fee9453ed22b49f3b7dc3ef8d.js
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.174.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-174-27.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f3879cbf119d2a99d9badd2bff1fa3d39b35264fee9453ed22b49f3b7dc3ef8d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 13 Oct 2023 22:08:07 GMT
Content-Encoding: gzip
Via: 1.1 9c8fea304cc4dc64f018a09a43cea24a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: CDG50-P1
Age: 1802996
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Fri, 22 Sep 2023 13:53:11 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: md5:fa14af52d1374458c05e30fea79949bf
ETag: W/"fa14af52d1374458c05e30fea79949bf"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=31536000
X-Amz-Cf-Id: dhxPlDb9Gwa_KbbdghhOIUqpVmsFCS-AEqI-y7Mjfkl7IgoVJJmtag==

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020530/ 8 KB
9 KB 667ms
117ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020530/square.jpg?1698925299
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: a07ff97c13e48e9fe2da98979cebdcb6904f96c414ba093b17e050c0a697e271

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 11:41:40 GMT
Server: AmazonS3
x-amz-request-id: NQ6V1CJY3092GGG0
ETag: "ec094721a324325a43f5468ab2a67144"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 8558
x-amz-id-2: 7Yxyw8QmKkcnypjwtN+jnd1CT5a0Jm9SDkGs6Cdp7BDr9k88WlJZyVcfVu+2hf/dAi1ONeimKec=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020527/ 8 KB
8 KB 620ms
103ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020527/square.jpg?1698670618
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: bcc835b2ee6597ab452678ef74797dc233b9a95e352ca4d367f733f0aa1ba2dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Mon, 30 Oct 2023 12:56:59 GMT
Server: AmazonS3
x-amz-request-id: NQ6SX3ETB6TP00RW
ETag: "c7ed170c61bdb7c3e6605ce090608521"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 7973
x-amz-id-2: Xaoz+QQ+XhpP1O6qQ4wFNuqcrHWoVvQARO2BE1PXjl5gzsaw+lLdY3Fi7iaPbyjC4oBnxT4Rj50=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020525/ 7 KB
7 KB 557ms
114ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020525/square.jpg?1698478906
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 21f9929be70d12eee913203bc3848ffa3f7865b4d74ddac987dad368a08fd6da

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Sat, 28 Oct 2023 07:41:48 GMT
Server: AmazonS3
x-amz-request-id: NQ6T5ZE33JXSXJJ6
ETag: "5b06b14acc2b85c34e84fe80651331c3"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 6791
x-amz-id-2: h+LOyqRe63EIFtvr0MN4X44bPpmWAM96szyVFgMK8K9EAYJi3iw/f0HB1dIztXfTPQ/HwINZsGg=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020524/ 9 KB
9 KB 555ms
104ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020524/square.jpg?1698439695
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: b36aa547e8e485976ad022c8b097bf98f045634aff31f9c8cae0aea0f0cd9cea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Fri, 27 Oct 2023 20:48:17 GMT
Server: AmazonS3
x-amz-request-id: NQ6YACW8DA7TJPF1
ETag: "c38833705a3046addf9ff758a8e4f2d6"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 9285
x-amz-id-2: r4t3apgEJaoLdn//BNFSGfYocDz/yOM8a34p7onxNongIMIX5c+faRjrLNowV1zqbWNMRKTCglk=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020522/ 9 KB
9 KB 565ms
114ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020522/square.jpg?1698065331
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 41e11c9e96c67d8e76c1421a8bbfb74beebba93f4c14de35b261707c90976ae1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Mon, 23 Oct 2023 12:48:53 GMT
Server: AmazonS3
x-amz-request-id: NQ6S60X55M7JVDM1
ETag: "b7e38e322bd2d8f04a1447946057910d"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 9163
x-amz-id-2: Q5boWAZi0kACxF8MhTVqnMnV7nSt1x9n9ImIxClEUaUB8c+YDHkfx6GfhLAD5dU68LbQBgA0Fyk=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020521/ 11 KB
11 KB 549ms
110ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020521/square.jpg?1697575781
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6b4c09c853d4c1b0139484034b53aafa8706cf3f1962b1f1dbe1dfd9f7d14c1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Tue, 17 Oct 2023 20:49:43 GMT
Server: AmazonS3
x-amz-request-id: NQ6JRH4KBCV1Z6E7
ETag: "cef6b0f81e165b48c79476086299f35c"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 10754
x-amz-id-2: Rus6zX7YBzlfCczdjfdhvgxXM6RCUG4dAuRQC5DY+C1uwQGtUDv9URavFlLGbQ8TLWzD8YngxEI=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020520/ 6 KB
7 KB 322ms
104ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020520/square.jpg?1697573759
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 9cc4bd778c6a763f2d0aa09e54ca117e54772b4f9d87f6447d289ac9e0eefa51

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Tue, 17 Oct 2023 20:16:01 GMT
Server: AmazonS3
x-amz-request-id: M9A627W308YPSXRN
ETag: "bac83eb4b424dd10710eacd3d42c3008"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 6477
x-amz-id-2: Vr6An56O+VOVC7RsQqV0zD1QCPnGmCSB5U8dB09+w5178xpyMtP4OqHfzSx1gD73j/LlTeq0bKQ=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020518/ 9 KB
9 KB 241ms
119ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020518/square.jpg?1697320952
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 4e59e06c7f416ca4193a16a7ea5127a0fb277b7da0923a84ebd54e0f4c01923e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Sat, 14 Oct 2023 22:02:34 GMT
Server: AmazonS3
x-amz-request-id: M9A7BNMNKA9BD0NV
ETag: "93a12971d107290e46a2eb6a69a37d14"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 8830
x-amz-id-2: 391ingsTCeYjRk7iuTEm60v5Vxmq6CbbnWNcIAuuC4lWR6FMJimWZjADhiGNkV5DXcAxL6cmMkU=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020515/ 11 KB
11 KB 361ms
134ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020515/square.jpg?1696681006
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6f5efcf297ccba73d6cd3ce25a82cec1dca3385b3019c8ed06275c7f45c73ac9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Sat, 07 Oct 2023 12:16:47 GMT
Server: AmazonS3
x-amz-request-id: M9AAM6G3V0JN01TZ
ETag: "549c370d0f25a885ae3ab85f3ba205ac"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 11267
x-amz-id-2: SBOMaF4FENT9knWZ8D3fyRGcglLjLk/DWF/JD2ci6nqbreuqdhKtYGIL9oaSQDNsMUtagm9u7Yc=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020514/ 8 KB
9 KB 227ms
114ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020514/square.jpg?1696584213
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 627f42a8d624a3cf8d46cc94afd628596b0a5f8ffa8c8558959398581d45fb26

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Fri, 06 Oct 2023 09:23:34 GMT
Server: AmazonS3
x-amz-request-id: M9AEA0FV8NP9WCJ4
ETag: "ac9d34dd6341eba9001d20e590dbe3f0"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 8579
x-amz-id-2: VJIuLO6xWbKvcLnKfGc3C9VIqeIBAQO5wln9DO7LEq1RWpDA1k+g6qFOFil+KtsC7DMK52mdKdE=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020513/ 4 KB
4 KB 246ms
123ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020513/square.jpg?1696509535
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 60569433b50ff6d836d1783ba1b8d71d62f86c069d45c599fa16211336f9242b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Thu, 05 Oct 2023 12:38:56 GMT
Server: AmazonS3
x-amz-request-id: M9AB8243FQ0J9DWE
ETag: "6e1a08fc5a6d3984b716b6909e4f23dc"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 3994
x-amz-id-2: kBtRaybjD4PSDYHi4aye9ZdcwoiIe4yUBI7woz68b7lqF60ra/h/mreu37DWe92fkFE5y6KSiYc=

GET
H/1.1 200
OK square.jpg
s3.amazonaws.com/bala.static/topic_photos/1020512/ 9 KB
10 KB 217ms
110ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/topic_photos/1020512/square.jpg?1696362666
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6ba0d41886d2bd37da3c6f34107fa0e92399b1cef61d6d0f2856fa38bc5f6a9b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Tue, 03 Oct 2023 19:51:07 GMT
Server: AmazonS3
x-amz-request-id: M9A6G7VEP6R9XW7M
ETag: "f13e0bcace19026d0d194ec9170986a9"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 9688
x-amz-id-2: JtYPsSFtmRF3gEyDh1F+D8xt/icyJ8HQgP27XUi0fh6Tgp2teBVaYRnZe7MykO/sVu+J+VQJw5c=

GET
H/1.1 200
OK small.jpg
s3.amazonaws.com/bala.static/avatars/187378/ 649 B
1 KB 242ms
119ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/avatars/187378/small.jpg?1625567660
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: d8d14f1416a5c7f640cdbe97359aba78652e4b7a7aad916f3186c07979833748

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Tue, 06 Jul 2021 10:34:21 GMT
Server: AmazonS3
x-amz-request-id: M9ABJ8MHBRDDFVZW
ETag: "1b6ee450ea12dd6726bcfcccd5b6a967"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 649
x-amz-id-2: plISKFqP+bZINij9OceSsOa9ZQT4lKwKEoTpUQP/RPauJashLIQcv2F2M5zZ3kxtIL19SVXri7E=

GET
H/1.1 200
OK missing.png
assets.balatarin.com/avatars/small/ 500 B
998 B 18ms
18ms Image
image/png 52.84.174.27
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.balatarin.com/avatars/small/missing.png
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.174.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-174-27.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03d5c445fbf76b8749bdac185d39ee6f2255ba15d67c66f10a7c69d978ac3faf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 18:51:25 GMT
Via: 1.1 9c8fea304cc4dc64f018a09a43cea24a.cloudfront.net (CloudFront)
Last-Modified: Sat, 30 Mar 2019 22:04:25 GMT
Server: AmazonS3
X-Amz-Cf-Pop: CDG50-P1
Age: 29289998
ETag: "24a925b59aad1a6cd61c43fb77941c20"
X-Cache: Hit from cloudfront
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 500
X-Amz-Cf-Id: oVlAuqaAVgHtADsPdZi2EgH7Ui8d6R-_0RtK0KhihYQ8nZpKUYNL9A==

GET
H/1.1 200
OK small.jpg
s3.amazonaws.com/bala.static/avatars/18530/ 619 B
1009 B 350ms
109ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/avatars/18530/small.jpg?1558425665
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: cd7c78c36287bd87d210152bcada1a602d0daf414497c4fcc55ceed1fb2a2edf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Tue, 21 May 2019 08:01:06 GMT
Server: AmazonS3
x-amz-request-id: M9A4STPWRT1JHHZF
ETag: "58be852485d6875f5a3b10e77e451cbd"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 619
x-amz-id-2: dNSSGyFoTa5VL6iPOnTpekRfaV88RlFFHwhaQC+YL4VORUhFD2oXJM6RIl1xWbSCD/kE3qfwgC0=

GET
H/1.1 200
OK small.jpg
s3.amazonaws.com/bala.static/avatars/122418/ 638 B
1 KB 349ms
108ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/avatars/122418/small.jpg?1591252973
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 69f2dd5a1d2db981d91b2cb9a239d9ed6a25c614a3decf75aa8e94af182fc6d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Thu, 04 Jun 2020 06:42:54 GMT
Server: AmazonS3
x-amz-request-id: M9AEBGJCEAB8RY09
ETag: "2da4f16cddc029c0137176b51c4d07fd"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 638
x-amz-id-2: 6fvFb2NtfTWFP9E3RrSKW9frMiE0Vyha5wp8nZwRmM4ZE1HUwM4HXjJ20IIiGvGfa2CvU6UPVT0=

GET
H/1.1 200
OK small.jpg
s3.amazonaws.com/bala.static/avatars/181707/ 657 B
1 KB 241ms
118ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/avatars/181707/small.jpg?1660330620
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 12080a1c23dc342aafdbe5a5643fb9c24204f8b5f092e190236af52f152f6a48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Fri, 12 Aug 2022 18:57:01 GMT
Server: AmazonS3
x-amz-request-id: M9AD1EWXK1WK9M93
ETag: "66d4a92337a41f565c612cfc9bd4ea85"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 657
x-amz-id-2: kAXzBehdPSJa3pfipmucwQP19cBE/VD5WmI4Ck/dlSmej9rlfx3hfZCOMnaJ32sWJ1hFt8mz+Io=

GET
H/1.1 200
OK small.jpg
s3.amazonaws.com/bala.static/avatars/189751/ 640 B
1 KB 110ms
110ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/avatars/189751/small.jpg?1653445088
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 2a28c1e44911a819f36aadfbcb300bd91a1da929ae8a63840ea2aef62cf915b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Wed, 25 May 2022 02:18:09 GMT
Server: AmazonS3
x-amz-request-id: NQ6PP9MS57BZY6FY
ETag: "a56b33edd31a8caef92c8ccb3902243e"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 640
x-amz-id-2: A+jKvkvqg0KWEytC0xv9RXZf0W2GGRIpg+Be0lMQMmgAux5IRGnTnd3XeHBjQfNlhjCgUkhzhKM=

GET
H/1.1 200
OK small.jpg
s3.amazonaws.com/bala.static/avatars/4094/ 639 B
1 KB 105ms
104ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/avatars/4094/small.jpg?1631606249
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 07d9be34265b21369f9e842b6f14032ca51803bc359df6994ca7f69bc29c1567

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Tue, 14 Sep 2021 07:57:31 GMT
Server: AmazonS3
x-amz-request-id: NQ6M1HFGBNV2QMT3
ETag: "a244c04af1ae0cce9cb3a7fb84a54f00"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 639
x-amz-id-2: 6cls7cykYWvTutZhE9RJtck85qbataUaPU7orXxZPPysM4OLhEJq+Y1/fl6FLj+xKDJDHl4ja+Q=

GET
H2 200 2.jpg
img.youtube.com/vi/Phulfb6IoSk/ 3 KB
3 KB 60ms
17ms Image
image/jpeg 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.youtube.com/vi/Phulfb6IoSk/2.jpg

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dca71ae85c56128fae9a00cf93d9336ce64542c349b8dfbee61443044a341fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:02 GMT
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2845
x-xss-protection: 0
server: sffe
etag: "1698845911"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=300
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 03 Nov 2023 19:03:02 GMT

GET
H/1.1 200
OK small.jpg
s3.amazonaws.com/bala.static/avatars/20866/ 670 B
1 KB 114ms
113ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/avatars/20866/small.jpg?1665063902
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0b82f6ba50e20af1cb331d1c2a706e2e0c6e7236ae08093705d10f1f94b9dda0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 06 Oct 2022 13:45:04 GMT
Server: AmazonS3
x-amz-request-id: NQ6TQBA94ASN8KX4
ETag: "ed16587147453b84f9e4a9c063b9b369"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 670
x-amz-id-2: 3FB3JZ375TZVwpdrkXiWei+rzUK5otTa4kGiUpXBCw92Jyh+98Z2iAcYOBAJZcD9FD8YTQ423Xw=

GET
H/1.1 200
OK small.jpg
s3.amazonaws.com/bala.static/avatars/105211/ 593 B
983 B 114ms
113ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/avatars/105211/small.jpg?1574138738
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 810a4b6938999adb1ab79d3e1da4b415fcbc377a47979a83a03c3fc920433770

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Tue, 19 Nov 2019 04:45:40 GMT
Server: AmazonS3
x-amz-request-id: NQ6ZF4YV6KN281ZY
ETag: "0848884fcbece62299deeebefce06a93"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 593
x-amz-id-2: yle31pRhkB3fGEdtbzbmxIxbJEhSUZAK85dPdmMUgpGlF9YZ8t1OXj2oDLrh5KsTKKeycNCVOZI=

GET
H2 200 onejs Show response
z-na.amazon-adsystem.com/widgets/ 22 KB
8 KB 145ms
33ms Script
application/javascript 52.222.166.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=072caa77-813c-41fc-84e3-1af5067d7f16
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.166.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-166-41.cdg52.r.cloudfront.net
Software: Server /
Resource Hash: 926e76861bd88a9da8f9522ee2bec8223494828c3f9d375b2421d10101081106

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: Public
date: Fri, 03 Nov 2023 18:57:19 GMT
content-encoding: gzip
via: 1.1 fd000a128e6bb534d86b423d2d506d52.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: CDG52-P2
age: 43
x-cache: Hit from cloudfront
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
charset: UTF-8
cache-control: public,max-age=300,s-maxage=300,no-transform
content-length: 7386
x-amz-cf-id: xSqKBQ5fjxvL45NRVIYhE1jbqicK1w9e5O-U27GIrWmwOPo0cVWzkw==
expires: Fri, 03 Nov 2023 19:02:19 GMT

GET
H/1.1 200
OK logo-c6042222156b5e26db18d7a25025e4b71e9c1d3d4cf90793e4030154b2dea1f5.svg
assets.balatarin.com/assets/ 4 KB
2 KB 17ms
16ms Image
image/svg+xml 52.84.174.27
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.balatarin.com/assets/logo-c6042222156b5e26db18d7a25025e4b71e9c1d3d4cf90793e4030154b2dea1f5.svg
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.174.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-174-27.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6042222156b5e26db18d7a25025e4b71e9c1d3d4cf90793e4030154b2dea1f5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 13 Oct 2023 22:08:28 GMT
Content-Encoding: gzip
Via: 1.1 16de6e3636993b2d3f832b9ae653bd68.cloudfront.net (CloudFront)
Last-Modified: Mon, 09 Nov 2020 23:17:47 GMT
Server: AmazonS3
X-Amz-Cf-Pop: CDG50-P1
Age: 1802975
ETag: W/"699129013888caccc30ce00dc03acd6f"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
X-Cache: Hit from cloudfront
Cache-Control: max-age=31536000
Connection: keep-alive
X-Amz-Cf-Id: WSLHP81YogbQOvqQjG1_Ccd8ejmiI6lQdknoWtXwHU4WYuoR5OOlKg==

GET
H/1.1 200
OK logo-footer-5b1979a4ecb584da673a08d6a737a10d87ae84aa6f5c2d18ab97da15c7462f11.png
assets.balatarin.com/assets/ 826 B
1 KB 17ms
17ms Image
image/png 52.84.174.27
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.balatarin.com/assets/logo-footer-5b1979a4ecb584da673a08d6a737a10d87ae84aa6f5c2d18ab97da15c7462f11.png
Requested by: Host: assets.balatarin.com
URL: https://assets.balatarin.com/assets/application-d0159fb0201b0c9e4b83f04fcca5096874700cd28a080507859919da3bd431c5.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.174.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-174-27.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5b1979a4ecb584da673a08d6a737a10d87ae84aa6f5c2d18ab97da15c7462f11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://assets.balatarin.com/assets/application-d0159fb0201b0c9e4b83f04fcca5096874700cd28a080507859919da3bd431c5.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sun, 16 Jul 2023 03:38:51 GMT
Via: 1.1 9c8fea304cc4dc64f018a09a43cea24a.cloudfront.net (CloudFront)
Last-Modified: Mon, 09 Nov 2020 23:17:47 GMT
Server: AmazonS3
X-Amz-Cf-Pop: CDG50-P1
Age: 9559152
ETag: "d6866d17619bc26a183d1c88f469f3e5"
X-Cache: Hit from cloudfront
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 826
X-Amz-Cf-Id: JJcPjfsvgpJZ2DvzZciLoYBLNn7WhK9uR68UnwsJ7AtFdmWBOW0iFQ==

GET
H/1.1 200
OK fontawesome-webfont-2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe.woff2
assets.balatarin.com/assets/ 75 KB
76 KB 56ms
22ms Font
binary/octet-stream 52.84.174.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.balatarin.com/assets/fontawesome-webfont-2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe.woff2
Requested by: Host: assets.balatarin.com
URL: https://assets.balatarin.com/assets/application-d0159fb0201b0c9e4b83f04fcca5096874700cd28a080507859919da3bd431c5.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.174.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-174-27.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://assets.balatarin.com/assets/application-d0159fb0201b0c9e4b83f04fcca5096874700cd28a080507859919da3bd431c5.css
Origin: https://www.balatarin.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Sun, 01 Oct 2023 02:27:09 GMT
Via: 1.1 f732889a761ee496e041d15e73c58bd6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: CDG50-P1
Age: 2910654
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 77160
Last-Modified: Mon, 09 Nov 2020 23:17:46 GMT
Server: AmazonS3
ETag: "af7ae505a9eed503f8b8e6982036873e"
Access-Control-Max-Age: 31536000
Access-Control-Allow-Methods: GET
Content-Type: binary/octet-stream
Access-Control-Allow-Origin: https://www.balatarin.com
Cache-Control: max-age=31536000
Access-Control-Allow-Credentials: true
Vary: Origin,Access-Control-Request-Method
Accept-Ranges: bytes
X-Amz-Cf-Id: I4f7ZMBQVe4bQTvjRst-orGQNFXOLgGDHTqaSAQBb5vDM4kakV3C4Q==

GET
H/1.1 200
OK 67f7e40d-91f8-43a7-a16b-b02c5b8cd573-thumbnail.jpg
s3.amazonaws.com/bala.static/links/ 9 KB
9 KB 335ms
115ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/67f7e40d-91f8-43a7-a16b-b02c5b8cd573-thumbnail.jpg?1698997279
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 5f811c2f6c3fab2007917f5a3826fc947f3d11ee2ef0f3cf7ef6d6200af8e2aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Fri, 03 Nov 2023 07:41:21 GMT
Server: AmazonS3
x-amz-request-id: M9A77E1N10TCZVNM
ETag: "040f1e76e21cf936e804a8b63e81a340"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 8807
x-amz-id-2: qCkHrTZnq1rnMRTp7ijUaqnuu5KMJ87g5gKLlO5Om39RgDimgTQLVHWkVem9kMxk9D/IkKTjv2g=

GET
H/1.1 200
OK 6066558.png
s3.amazonaws.com/bala.static/links/ 5 KB
6 KB 432ms
109ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6066558.png?1698925515
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 73dbaad7ff53afb9724f6a9e337b1d92ca4d0f23604a26340e141bedb1034179

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 11:45:16 GMT
Server: AmazonS3
x-amz-request-id: NQ6ZGZ0VW51X70PW
ETag: "21e4f6680dcbd1478188fbc2481fbe48"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 5298
x-amz-id-2: m6vliRPVSj6azhbZV4/C1TcxUOxqGuicuHblC/ZlG8Gll0w2Nn8suronuFg87VxPpadl+e8+OAg=

GET
H/1.1 200
OK 440eb568-c079-4399-a981-ec4d695040ea-thumbnail.jpg
s3.amazonaws.com/bala.static/links/ 4 KB
5 KB 328ms
111ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/440eb568-c079-4399-a981-ec4d695040ea-thumbnail.jpg?1698936770
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: b3390fb9855914c762c445b520c6f99986a6d72321773c32af53fea7fbbbbbd2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Last-Modified: Thu, 02 Nov 2023 14:52:51 GMT
Server: AmazonS3
x-amz-request-id: M9A76E7GWQDJVXWB
ETag: "6d807a9172a80a9c6e3d9444a0f89509"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 4582
x-amz-id-2: JLLaEdVeqH24Qs29LbxVQfrWTPN6jQXqxEIiPvXHSSXMboAMSxP5ddmQ9TYcmxyxL9ltTkRof34=

GET
H/1.1 200
OK 6066489.png
s3.amazonaws.com/bala.static/links/ 3 KB
3 KB 400ms
104ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6066489.png?1698917113
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6ae03a9f3ce2f04813b6fa58a8d0f093caa85c01f1a4183cc2a625be1dee814c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 09:25:14 GMT
Server: AmazonS3
x-amz-request-id: NQ6N7H7FB24VTNK6
ETag: "291cf9c70c3a4df092489183a838ee73"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 2987
x-amz-id-2: E67lc3lPS1GXn1plSpJTocGk3pu8rKrf4Qe03+ydrWKXpdwx2KHlnPSI+42B92xpr7hA43dNhvM=

GET
H/1.1 200
OK 6066551.png
s3.amazonaws.com/bala.static/links/ 13 KB
13 KB 104ms
103ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6066551.png?1698924650
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: aa38115ab496b6f1eba6105087c95e485c36be8293c750ad49e8c5ec44e291e8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 11:30:51 GMT
Server: AmazonS3
x-amz-request-id: NQ6PR4726983YR75
ETag: "4923836f25e47449c79155da36fb18e7"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 13089
x-amz-id-2: 6yHBJKuE1+HiIkppj+Ug798r/8hM6c88pZXXjIZXnB3bAndQpbpZgkVbhwS15x5HUo7ixsBwx6g=

GET
H/1.1 200
OK bba406ab-b337-4404-9574-d3823e840784-thumbnail.jpg
s3.amazonaws.com/bala.static/links/ 3 KB
3 KB 107ms
107ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/bba406ab-b337-4404-9574-d3823e840784-thumbnail.jpg?1698939751
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: c067cb7a26be0a90f3ebf4f385f5220b95618faf05ebb49178c7e1f5e4f16bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 15:42:32 GMT
Server: AmazonS3
x-amz-request-id: NQ6KS3M2030M6QN2
ETag: "b7abf1325cbf2edb208c91889496b74a"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 2682
x-amz-id-2: CUHUMqEHS2AwzK8QrHHspjtSIfjhL96/njHTRng7K+2bB8oj7i1cVP8CWi5TOC6WCUZxKj6dva8=

GET
H/1.1 200
OK 7d56db60-326b-4185-9bd1-65f840cfeec8-thumbnail.jpg
s3.amazonaws.com/bala.static/links/ 5 KB
5 KB 111ms
111ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/7d56db60-326b-4185-9bd1-65f840cfeec8-thumbnail.jpg?1698939494
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: a247c99a78ea116295aa3f59a80167e092af8c23776f3d3c09e805d365d766a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 15:38:15 GMT
Server: AmazonS3
x-amz-request-id: NQ6VN94PYAVET317
ETag: "731c61b22e621129d8ef6930bbc1fafc"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 4631
x-amz-id-2: zU08rE/wC2KUxn3tARFglEjNi2Ska5d8DmSd/flUPH2x5/nQw64PKgj3Fsk4EZJl2PMX8si4gVY=

GET
H/1.1 200
OK f74f4384-0b55-465b-b74c-3b5f68c6500b-thumbnail.jpg
s3.amazonaws.com/bala.static/links/ 4 KB
5 KB 110ms
110ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/f74f4384-0b55-465b-b74c-3b5f68c6500b-thumbnail.jpg?1697806181
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 43148c46e3ce875a4ef8bf45f9f9ea3efefa07450d0277758d61e17ed2428b33

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Fri, 20 Oct 2023 12:49:43 GMT
Server: AmazonS3
x-amz-request-id: NQ6K9VBJ4YY4V8MJ
ETag: "b7043e90e21f727aa5d1da44311ce9d4"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 4472
x-amz-id-2: GGx6qA6vD7jgsMjDOyOpMDMj1f6XMRHw9eb8JvZDPXNbbRdmboZbdqBkR52RfEikRRbTrl+Tneo=

GET
H/1.1 200
OK 6066384.png
s3.amazonaws.com/bala.static/links/ 2 KB
2 KB 110ms
110ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6066384.png?1698905714
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: cc6aaa0fa32d21150815dc89592f165779dbdde4c2d8954b497422bac422f970

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 06:15:15 GMT
Server: AmazonS3
x-amz-request-id: NQ6P6CHZJ8A0J7PN
ETag: "60249c269aa9530ae94b10162937c74e"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 1835
x-amz-id-2: nKyoIFDzWkmXk5aFsNw0xQZgBcV50CHRN6K3JkB2uLBWcZ0vB8IGOYkhZURFEEeE0xGgtFAuMYE=

GET
H/1.1 200
OK 6b31c009-2b39-4ed4-92d9-edb6c786f8eb-thumbnail.jpg
s3.amazonaws.com/bala.static/links/ 5 KB
5 KB 118ms
117ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6b31c009-2b39-4ed4-92d9-edb6c786f8eb-thumbnail.jpg?1698940965
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 268074f768701b86b9486b3950d49c5029cc03eaaa596a9ea086350c4412b1d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 16:02:47 GMT
Server: AmazonS3
x-amz-request-id: NQ6QEVMDBY7YDF6S
ETag: "4ae1f2eca4e43b780efa0d07a19ff8b0"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 4906
x-amz-id-2: r81Hax8ODLBzXVqajV2kLA6FdIZAWXoRuTNfzrVSYSZEkwGI6KJllkIe7ITu3BCECP0wOk36DHc=

GET
H/1.1 200
OK 6066404.png
s3.amazonaws.com/bala.static/links/ 4 KB
4 KB 101ms
101ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6066404.png?1698910326
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: ba8f1261d5b5aaf9c05d6879886b7c04a10cc1165210ecd1b826272ee54370e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 07:32:07 GMT
Server: AmazonS3
x-amz-request-id: NQ6NDKCC0FBA872E
ETag: "f56ee03621a0fe40dffe07d6d259154a"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 3592
x-amz-id-2: uoZTmXUDjkwl8GqodJ6Ztn00eVklNqb0z79zYrxRz2xnccwrE6GoBn3GLpedNbZ/GvJogI5VnYk=

GET
H/1.1 200
OK b8bc3390-beb2-4e78-9bad-95f26d4aa5fc-thumbnail.jpg
s3.amazonaws.com/bala.static/links/ 3 KB
4 KB 105ms
105ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/b8bc3390-beb2-4e78-9bad-95f26d4aa5fc-thumbnail.jpg?1698932386
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 17f83a1ecedecae8428995c7dd273ce075247a0331829b1e1b11284c1a116fd9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 13:39:47 GMT
Server: AmazonS3
x-amz-request-id: NQ6NH0ZWM96HZDA4
ETag: "6746b2813706d7aaf6518096d091273c"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 3193
x-amz-id-2: F+k3l3GfmlzckAVbqCj1d1OjEY7YBJW9cWQUu1H6t/WvcIoOnr8ulSVTCAwr+8ho/ulLhYuHgmI=

GET
H/1.1 200
OK 180d5526-94e7-4c73-8440-589b0a4c4940-thumbnail.jpg
s3.amazonaws.com/bala.static/links/ 5 KB
5 KB 110ms
110ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/180d5526-94e7-4c73-8440-589b0a4c4940-thumbnail.jpg?1698933453
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0e84c29fa36d8c5f38189f379f60ec78a164cbe01bcd27e5443d6aedf4e4748d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 13:57:34 GMT
Server: AmazonS3
x-amz-request-id: NQ6N0ZRQXEGG5Y5X
ETag: "1ec2862c46a2ea09f492b4ceb23a4f23"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 5148
x-amz-id-2: q2UDdXN1qGLOkkAmR1kRKAtslUyXXwhbQQzdr/Mw67tYaYk+7Ug+9zVDDJ3BMtAVxDt7uJD8ZPI=

GET
H/1.1 200
OK 6048706.png
s3.amazonaws.com/bala.static/links/ 2 KB
2 KB 110ms
110ms Image
image/png 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6048706.png?1695620417
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6046c8481b852fe24067c203ca71a0d0b04dd4f5e364c7ebba3c7acb998a993b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Mon, 25 Sep 2023 05:40:18 GMT
Server: AmazonS3
x-amz-request-id: NQ6YWM966VZ6S11N
ETag: "9cc1a5bd15a06d3192bd7025793e988d"
x-amz-server-side-encryption: AES256
Content-Type: image/png
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 1964
x-amz-id-2: CXcMw3Bl+/9be35nBmypvcQ00+oOkSYIn29tO459Pu0N3OFrPJtKgvfw2R90vKDgR1CH9DdBzGA=

GET
H/1.1 200
OK 6066407.png
s3.amazonaws.com/bala.static/links/ 6 KB
6 KB 112ms
112ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6066407.png?1698910513
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: ae9114286e948928f5dc578981a2d4c2e968ed8dde80d5106d66b6ee62a586d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 07:35:14 GMT
Server: AmazonS3
x-amz-request-id: NQ6V995J4GFTS7A2
ETag: "158bf20cc15cfb4a79b19e939eca00a0"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 6129
x-amz-id-2: aWzLx1d9cGwg0aP/ugWso/+JVtxOjyha5Jci5X5G63+hBZy7iIVJCaHgHZobxZMVL+RXsUXz6OY=

GET
H/1.1 200
OK 6066395.png
s3.amazonaws.com/bala.static/links/ 10 KB
10 KB 111ms
111ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6066395.png?1698908235
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 8d12e48a7e782a82ef6280881eb2ceb75b939a57448c294b4396ae50fae34fdf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 06:57:16 GMT
Server: AmazonS3
x-amz-request-id: NQ6KBGBPACVFFF1Q
ETag: "3b3edf0d0d7fdc326a8b19586b77331f"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 10242
x-amz-id-2: RQ3OMyHBiZreSV/4slnPyHX7zPxFZtUuuHUbsyT4T1LTK1tP3He34lQ/690aMo+wqrKfOeUFHCo=

GET
H/1.1 200
OK 6066453.png
s3.amazonaws.com/bala.static/links/ 22 KB
22 KB 106ms
106ms Image
image/jpeg 52.217.17.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/bala.static/links/6066453.png?1698914415
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.17.238 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: a965b3e5c3976c06f59fd036231b746c1b0345b0aea5043f177856c3af40e7a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Last-Modified: Thu, 02 Nov 2023 08:40:16 GMT
Server: AmazonS3
x-amz-request-id: NQ6QR5HA4GWHEAVV
ETag: "e04d3e3e572d8490348fef19ebc44df8"
x-amz-server-side-encryption: AES256
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Length: 22419
x-amz-id-2: gsuihy865cPEJyv2KLRNMva1g2POY3exVbRK1biwKbdxKpPagbCv6XuGTV0vbxdfcEEX6QfHows=

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/ 425 KB
133 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e8cf20f6e98c91ff5a877209649b0839bb06e5751793babfb0dbbbb60a9e811a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 10:57:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28856
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 136288
x-xss-protection: 0
server: cafe
etag: 17302374607849014435
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 02 Nov 2024 10:57:06 GMT

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310310101/ 399 KB
135 KB 94ms
94ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310310101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7031645305449270&plah=www.balatarin.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

82dcc5d3b76b02619e6d68742a9ae39eee3c3a773530c2b655e654071fb3b2dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138245
x-xss-protection: 0
server: cafe
etag: 5243605663044923538
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 03 Nov 2023 18:58:02 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231101/r20190131/ Frame 45ED 10 KB
5 KB 29ms
7ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231101/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.balatarin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 64600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 01:01:22 GMT
etag: 251720774729838433
expires: Fri, 17 Nov 2023 01:01:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 68 KB
25 KB 66ms
65ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3561240333002577&correlator=659480271558393&output=ldjh&gdfp_req=1&vrg=202310310101&ptt=17&impl=fifs&iu_parts=3679856%2CSidebar-Middle&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C336x280&ifi=6&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1699037882861&lmt=1699037882&adxs=290&adys=1793&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Fwww.balatarin.com%2F&vis=1&psz=336x0&msz=336x0&fws=0&ohw=0&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=false&dlt=1699037882433&idt=404&adks=3772982170&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c294c65db9b2c64c66eb2e7321e99650fec8f33ac8cf01bfa996a1680fc0c702

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:02 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25197
x-xss-protection: 0
google-lineitem-id: 1279745296
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 113000655376
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.balatarin.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
ec2a47f34a564aae26f22e5e536bf217.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 00A7 6 KB
3 KB 68ms
15ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ec2a47f34a564aae26f22e5e536bf217.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.balatarin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:02 GMT
expires: Sat, 02 Nov 2024 18:58:02 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 953E 0
0 45ms
45ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvlY1Xu3AvW8LtPq0x8uzvcIoM20aiBvBrx_lx_Xck-pSTbHYI0dozQaG_RBRoIqahsSGpJp_Ek_OKfvCg3Dlk3NndRfysVGmjMprCL20mR__63e-hgm7_uZ-nR5xuE8_iQQZ9_avknm_d6__8iyK1chscW4E7E7nwbjVNy1WZnz7h2T2D6ST6KHzX_aE8SZx96OodY4e6bMejyZm-eqUva85jCHvvKZ9Gjp9hCfvo5LnVZOgBxAPcvhvDX1zBpd-bpWFbNyfN4ujQgCVPvfUFiaeUtfmJ8-5IEP1_0aoISDs-24mlIsrOiBgE6WQ5oYmxwQpb2ma5umQ&sai=AMfl-YTxQBLFdqQPpu0eHprZaYsKiCExTurq4x68jF_y6pSHNDj46OW-EdvPkb4tbJGWS-4GnuMTKgGJ7x7_di--sBr0KLNowckm7RSLrictA6pnyKasUKK9XdblaAdsEJOXFuNoOHJz5pcrjhXbBkk&sig=Cg0ArKJSzEKgUIX2CKPjEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 03 Nov 2023 18:58:02 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231101/r20110914/ Frame 953E 23 KB
10 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231101/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

961f547cdb29f79eed49fddf9c4867b1f8589facfe487d6055c512950db7a914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 19:21:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84976
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9345
x-xss-protection: 0
server: cafe
etag: 15168757854195530193
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Nov 2023 19:21:46 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/ Frame 953E 3 KB
1 KB 30ms
9ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 11:05:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28372
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 17 Nov 2023 11:05:10 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 953E 189 KB
60 KB 59ms
17ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7b6ac83d0a5dbb3a50fb28ff292d09cdd262834c50beb293d9aad1550eac5a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60699
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698838693892887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Nov 2023 18:58:03 GMT

GET
H2 200 11014814240268210796
tpc.googlesyndication.com/simgad/ Frame 953E 35 KB
36 KB 29ms
9ms Image
image/jpeg 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11014814240268210796

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e581c3bf6f9547d2b323c8e1ab6546470435b69417d12984bc0fb08c90307112

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 12:53:56 GMT
x-content-type-options: nosniff
age: 540246
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36079
x-xss-protection: 0
last-modified: Mon, 11 Apr 2016 23:11:34 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 27 Oct 2024 12:53:56 GMT

GET
DATA 200
OK truncated
/ Frame 953E 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 473d889b2e7148550316947a833cc23762d90bf7435ec4635afef1d9fe23970d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 217 B
554 B 156ms
15ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.balatarin.com&callback=_gfp_s_&client=ca-pub-7031645305449270&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310310101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7031645305449270&plah=www.balatarin.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d2892bbf85a629d03f004557d6e0aefbe97699a83336eda44d380f4d2fddd3bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3756 19 KB
5 KB 202ms
196ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&adk=1812271804&adf=3025194257&lmt=1699037883&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x945_l%7C212x945_r&format=0x0&url=https%3A%2F%2Fwww.balatarin.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882786&bpp=5&bdt=353&idt=242&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&nras=1&correlator=225557828045&frm=20&pv=2&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=266

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5274718f391114e7202c44cd51531a9c25857e8779796703252cafd10de8db5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.balatarin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 5315
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&cls=navbar%20navbar-default%20navbar-fixed-top%20navbar-headroom&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3BF0 32 KB
13 KB 334ms
329ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a9eb186c2c4bfd02940bf4ff9dfe8f92315a940caf688f01b24bc56d3f098de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.balatarin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 13565
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 953E 0
0 81ms
45ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstWxvvLfb-Z4TEFPr2i4l9exCca69EW6tq_KSG5jaVjE62Y_jt_R2ms07xAdmipxY1hV65a5RJ2T9X3IKxK63X9oCq-gDf8vFwe-QEO541I664xmMghEX0dJRuEPly5TJgnlENocGZH4xrIyVI3WVDRvAXtT40D3shu9spTLEV6iAVnTrIhfybZjcpk6lQonMnm4Woeua80EL6V1lMFCHQerf67HCqIaX0CRFlIopFNmJFOtO_rOnGKG8vHBt9PXgx7uxvDsDgvUIrOhq06m_Vjz2Jmj9y1K_pgU6lCaGPqOFwh2R4nFz9npOJb7WaSlCeblW012Sn6ScAw&sai=AMfl-YRrhhQMoXhaXOR3gczP5VW_B_hUuwI4-cd7dQpPIvQ1B1CvWQsjTj3ho17MwE5rGheY2DLiZc5MAElqVGUOr9YLR2x4JIyrtN8MVjciDJmookZlq35oxnjAvk89uw7FMsuCH1iSkMHFn9-dYq4&sig=Cg0ArKJSzG0QIXe9IznoEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 03 Nov 2023 18:58:03 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8D11 114 KB
46 KB 335ms
331ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=5688324856&adk=4223602507&adf=1525804284&pi=t.ma~as.5688324856&w=336&fwrn=4&lmt=1699037883&rafmt=12&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&efwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882793&bpp=1&bdt=359&idt=314&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=243&ady=200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&xpc=RSslOf47GR&p=https%3A//www.balatarin.com&dtd=317

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4310f844f0e1527b87404aac978e04719093450ba00c9b9f38af330939e62e3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.balatarin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46715
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0D2F 114 KB
46 KB 412ms
409ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=8352827426&adk=3914965158&adf=2248382236&pi=t.ma~as.8352827426&w=336&fwrn=4&fwrnh=100&lmt=1699037883&rafmt=1&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882794&bpp=1&bdt=361&idt=319&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90%2C336x280&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=254&ady=1018&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&xpc=gkPueaxurS&p=https%3A//www.balatarin.com&dtd=321

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c0a54c4739533ca549e95dc9dbbe6b261e18652c8a4b04faca1acee8f864756

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.balatarin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46779
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A121 430 B
226 B 172ms
171ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&adk=2481526797&adf=47773877&pi=t.aa~a.2729612806~rp.1&w=358&fwrn=4&fwrnh=100&lmt=1699037883&rafmt=1&to=qs&pwprc=6379213746&format=358x280&url=https%3A%2F%2Fwww.balatarin.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037883436&bpp=1&bdt=1003&idt=1&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8-22aadafc25e30044%3AT%3D1699037882%3ART%3D1699037883%3AS%3DALNI_MYFrSs6Yo02OrnvEr1O2QqdTUvFHw&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90%2C336x280%2C336x280&nras=2&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=231&ady=2082&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=2&fsb=1&xpc=lUMP9Vb187&p=https%3A//www.balatarin.com&dtd=6

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

713aef7883e58ad15857e8cae3d34335ab309882218fed5147cb558dd0d4877c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.balatarin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 205
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 774F 624 B
242 B 49ms
48ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUW_nt5Ep4vOXqTxKuq0SnL7Q3NcM3dET13uYIajofivuOVgLAD4DPwF9XBzplYb8r7xO9FcEH_rVu424dCGkg4gUg_ypKGwBya2dfVUERbdlSFujVuC9Or6Vr6y_hhoRCL8prQkvZGbbplTMpc-p82NptimQjasl3-DPFUYodnfwqyDVk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D072 89 KB
31 KB 70ms
70ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 03 Nov 2023 18:58:03 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/ Frame D072 3 KB
1 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 11:05:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28373
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 17 Nov 2023 11:05:10 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/ Frame D072 20 KB
9 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11435640d1ed2fa5f24ccd7f074b66c4d191a97a2931e793be6799d2b6a5e459

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 19:20:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8610
x-xss-protection: 0
server: cafe
etag: 7739385728678230190
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Nov 2023 19:20:48 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame D072 0
0 40ms
13ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRaJVntkr3ErhQoe8wt0Kj6CxeJFcqXEE7Yes9mc7PTEXYqExcII0G6vguE5iETRBkFwisqrWPKxQ6y8upw5s2NWqagjw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D072 189 KB
59 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7b6ac83d0a5dbb3a50fb28ff292d09cdd262834c50beb293d9aad1550eac5a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60699
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698838693892887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Nov 2023 18:58:03 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D072 42 B
63 B 41ms
40ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A37dO_xUJdymbOoOiE-tqX0WF3EGNh2hx4RgdrO14Ny2unsKrY7C_0AJM_OEf7-0cc_vWhM_zRmOGvkafwKfddFHuFqAaMhMvciNhNPAKK-0PAOD8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D072 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1154606877951486260&x=1&ct=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BFA8 624 B
242 B 47ms
46ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXlDqsbTjrnSm99tkN4jb_WMkDmRR_TRq7Ak5w8UCe8ALb01vDZohNEf7JJs9MchXb2dKpUpZT57v6NvxtZceBj1JIQPhD-eqlt3g0uPIdFXIOMzfLUtrGg0pF-V1qmUGPDw4aU5kI_m3brp7zN4JI1Z_-on1xdTZBHgP5qlHA1WN2XjT4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=5688324856&adk=4223602507&adf=1525804284&pi=t.ma~as.5688324856&w=336&fwrn=4&lmt=1699037883&rafmt=12&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&efwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882793&bpp=1&bdt=359&idt=314&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=243&ady=200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&xpc=RSslOf47GR&p=https%3A//www.balatarin.com&dtd=317

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=5688324856&adk=4223602507&adf=1525804284&pi=t.ma~as.5688324856&w=336&fwrn=4&lmt=1699037883&rafmt=12&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&efwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882793&bpp=1&bdt=359&idt=314&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=243&ady=200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&xpc=RSslOf47GR&p=https%3A//www.balatarin.com&dtd=317
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 19A5 172 KB
61 KB 43ms
7ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 07:14:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42207
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 07:14:36 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/elements/html/ Frame 19A5 7 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 20:17:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Nov 2023 20:17:00 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/ Frame 19A5 23 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/abg_lite_fy2021.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

961f547cdb29f79eed49fddf9c4867b1f8589facfe487d6055c512950db7a914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 19:25:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9345
x-xss-protection: 0
server: cafe
etag: 15168757854195530193
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Nov 2023 19:25:22 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 19A5 41 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:17:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16804
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Nov 2024 14:17:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/ Frame 19A5 3 KB
1 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 11:05:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28373
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 17 Nov 2023 11:05:10 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BAA1 1 KB
643 B 9ms
8ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59756
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 02:22:07 GMT
etag: 48472445140208031
expires: Sat, 04 Nov 2023 02:22:07 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/ Frame 19A5 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11435640d1ed2fa5f24ccd7f074b66c4d191a97a2931e793be6799d2b6a5e459

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 19:20:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8610
x-xss-protection: 0
server: cafe
etag: 7739385728678230190
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Nov 2023 19:20:48 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 19A5 0
0 16ms
14ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSkh9eblM0Kml27d-tfLjjECKTM4xY8GBbN4wSwnrBXYiZn9MFN1n5runz-wpIU8J3l4SoEkCs0W4JgkpprJ-m0pc2yow
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=5688324856&adk=4223602507&adf=1525804284&pi=t.ma~as.5688324856&w=336&fwrn=4&lmt=1699037883&rafmt=12&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&efwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882793&bpp=1&bdt=359&idt=314&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=243&ady=200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&xpc=RSslOf47GR&p=https%3A//www.balatarin.com&dtd=317
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 19A5 189 KB
59 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7b6ac83d0a5dbb3a50fb28ff292d09cdd262834c50beb293d9aad1550eac5a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60699
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698838693892887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Nov 2023 18:58:03 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 19A5 42 B
63 B 41ms
40ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BISDUS735RHLZHF6MkB1NYHu5xlS4OffA82VcNXZe-X-gNhacBU7ua99YqDBY63KEMQE9aV_vOX_GjxA9UZei9rMDe3o6ckMau4fMX1fD6RgOQ4bo

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 774F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

43 B
768 B

29ms
26ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUW_nt5Ep4vOXqTxKuq0SnL7Q3NcM3dET13uYIajofivuOVgLAD4DPwF9XBzplYb8r7xO9FcEH_rVu424dCGkg4gUg_ypKGwBya2dfVUERbdlSFujVuC9Or6Vr6y_hhoRCL8prQkvZGbbplTMpc-p82NptimQjasl3-DPFUYodnfwqyDVk
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6sccVB25ElbT2768VCjZmp%2BecfsbiDOL66COHR8t7Vw25XWpuCDL5Z9SurFY9AJfeK8MkgsN4Rvlq3hXjH5mRWI0QYJYMg8WxPU%2BWHrKyW1V7ON2oeiLBAOSRLLcJbOqxaR4zZGaFzU4Tw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8206d8b50bca91fb-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 774F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUVCu5HZvqm8cQ5tSTXXTgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

43 B
731 B

20ms
20ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUW_nt5Ep4vOXqTxKuq0SnL7Q3NcM3dET13uYIajofivuOVgLAD4DPwF9XBzplYb8r7xO9FcEH_rVu424dCGkg4gUg_ypKGwBya2dfVUERbdlSFujVuC9Or6Vr6y_hhoRCL8prQkvZGbbplTMpc-p82NptimQjasl3-DPFUYodnfwqyDVk
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CmbKSVT0tyJvxnh840QZ3qFgM%2FCTHFpPOZejZ8Zxun4D7smofLfYSiZ4XOVnN28OAFIbQmAkRr83BZbCyQGwxCzmtTjiFbtpC65t3Pjlx7Fg1RdhzdZXc0pLF8A8CYTgSIx5J1y6N5Wx3A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8206d8b53be291fb-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 774F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1

43 B
841 B

33ms
30ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUW_nt5Ep4vOXqTxKuq0SnL7Q3NcM3dET13uYIajofivuOVgLAD4DPwF9XBzplYb8r7xO9FcEH_rVu424dCGkg4gUg_ypKGwBya2dfVUERbdlSFujVuC9Or6Vr6y_hhoRCL8prQkvZGbbplTMpc-p82NptimQjasl3-DPFUYodnfwqyDVk

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
an-x-request-uuid: 9f4a81de-b422-4f47-95ab-043f4fc9bdb0
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 774F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D

170 B
188 B

24ms
24ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
an-x-request-uuid: 216622f8-fbf3-4d22-98dc-98846143ddec
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D
x-proxy-origin: 138.199.38.133; 138.199.38.133; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame BFA8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

43 B
341 B

29ms
28ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXlDqsbTjrnSm99tkN4jb_WMkDmRR_TRq7Ak5w8UCe8ALb01vDZohNEf7JJs9MchXb2dKpUpZT57v6NvxtZceBj1JIQPhD-eqlt3g0uPIdFXIOMzfLUtrGg0pF-V1qmUGPDw4aU5kI_m3brp7zN4JI1Z_-on1xdTZBHgP5qlHA1WN2XjT4
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Het0pyyC3NmSq7GYNMAVJuLKcaPg3j2cqSudNqpqi5sA%2FBh043Chn06P%2BN9soouiwy%2FqxDtGnUkNTZaq7%2F%2FGwmvUDp%2FXYo35Ro7GPoyan0KF5ATziP7Y8oQ1T2ajFuQUmbghyp%2FHLM7mWw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8206d8b4da3c65be-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame BFA8
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUVCu5HZvqm8cQ5tSTXXTgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

43 B
731 B

21ms
20ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXlDqsbTjrnSm99tkN4jb_WMkDmRR_TRq7Ak5w8UCe8ALb01vDZohNEf7JJs9MchXb2dKpUpZT57v6NvxtZceBj1JIQPhD-eqlt3g0uPIdFXIOMzfLUtrGg0pF-V1qmUGPDw4aU5kI_m3brp7zN4JI1Z_-on1xdTZBHgP5qlHA1WN2XjT4
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AY7fib6XmW5pDH5WOxnQcuYhxcfi%2Fufz9cB2seJzus7EJITfVLNdYl6e9cgV%2F5%2FTqyNqxVxE2AabQWppCKFJiMhLsUVhYmPKsBNLSJG9Hi0Pa78efyRuViyOONB58ld7p07fucYB70rNLA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8206d8b53be491fb-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame BFA8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1

43 B
841 B

21ms
17ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXlDqsbTjrnSm99tkN4jb_WMkDmRR_TRq7Ak5w8UCe8ALb01vDZohNEf7JJs9MchXb2dKpUpZT57v6NvxtZceBj1JIQPhD-eqlt3g0uPIdFXIOMzfLUtrGg0pF-V1qmUGPDw4aU5kI_m3brp7zN4JI1Z_-on1xdTZBHgP5qlHA1WN2XjT4

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
an-x-request-uuid: 882429c7-5fe6-437e-a151-f674c3c9857f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BFA8
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D

170 B
188 B

26ms
25ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
an-x-request-uuid: d7995389-e8f7-4d56-92e6-f68605df8c23
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D
x-proxy-origin: 138.199.38.133; 138.199.38.133; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 19A5 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77a9569403b6c090b10b0903da228e132b27b8e24c59be4eecb14e8e1b3a7fbe

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 93E9 624 B
242 B 48ms
48ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXYPb_sOKSACRhHLm0JjsYxcLTjksKi1Nm0aYe57d0USm_hiUc7Z9ewoERlVSJDShMWzrsr_vnfDnqsscLGJ2znzc52GJsr_3eaRBjaFB9GbQv4MWRkVWntpDIVPlJst1J0nUfc35W9nP1ZyQ3MU_0YqplhcXwkT3M-S8PoOMKg9XOkC_s

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=8352827426&adk=3914965158&adf=2248382236&pi=t.ma~as.8352827426&w=336&fwrn=4&fwrnh=100&lmt=1699037883&rafmt=1&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882794&bpp=1&bdt=361&idt=319&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90%2C336x280&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=254&ady=1018&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&xpc=gkPueaxurS&p=https%3A//www.balatarin.com&dtd=321

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=8352827426&adk=3914965158&adf=2248382236&pi=t.ma~as.8352827426&w=336&fwrn=4&fwrnh=100&lmt=1699037883&rafmt=1&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882794&bpp=1&bdt=361&idt=319&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90%2C336x280&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=254&ady=1018&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&xpc=gkPueaxurS&p=https%3A//www.balatarin.com&dtd=321
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 2744 172 KB
60 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 07:14:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42207
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 07:14:36 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/elements/html/ Frame 2744 7 KB
3 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 20:17:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Nov 2023 20:17:00 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/ Frame 2744 23 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231101/r20110914/abg_lite_fy2021.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

961f547cdb29f79eed49fddf9c4867b1f8589facfe487d6055c512950db7a914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 19:25:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9345
x-xss-protection: 0
server: cafe
etag: 15168757854195530193
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Nov 2023 19:25:22 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 2744 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:17:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16804
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Nov 2024 14:17:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/ Frame 2744 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 11:05:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28373
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 17 Nov 2023 11:05:10 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5327 1 KB
643 B 9ms
7ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59756
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 02:22:07 GMT
etag: 48472445140208031
expires: Sat, 04 Nov 2023 02:22:07 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/ Frame 2744 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231101/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11435640d1ed2fa5f24ccd7f074b66c4d191a97a2931e793be6799d2b6a5e459

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 19:20:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85035
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8610
x-xss-protection: 0
server: cafe
etag: 7739385728678230190
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Nov 2023 19:20:48 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 2744 0
0 17ms
14ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQKIcbl5e3u-npynrbK0FkXrhVz-w047MZ_V3S6AH__emkGp0rkLvj-uWdE3iU5xiUglGMmJw9pBhngWQrs1dl3LVY3RA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=8352827426&adk=3914965158&adf=2248382236&pi=t.ma~as.8352827426&w=336&fwrn=4&fwrnh=100&lmt=1699037883&rafmt=1&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882794&bpp=1&bdt=361&idt=319&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90%2C336x280&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=254&ady=1018&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&xpc=gkPueaxurS&p=https%3A//www.balatarin.com&dtd=321
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2744 189 KB
59 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7b6ac83d0a5dbb3a50fb28ff292d09cdd262834c50beb293d9aad1550eac5a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60699
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698838693892887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Nov 2023 18:58:03 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2744 42 B
63 B 44ms
43ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CmBQkE5kuAzeQOiJpb_UpW4nvlFGn_TJ0A7wNCZ4UzV8Z1QF9C_JbfDPSB9vz4Ab5AI5GzZDgNIFKpm1Wql3A-Eoz_somn-f78ISJj4WSgDysrSbk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D072 0
20 B 41ms
40ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=322989734788&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D072 0
20 B 40ms
40ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=322989734788&version=m202309260101&ct=77&x=1&cor=1154606877951486200

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D072 19 KB
13 KB 48ms
46ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DjHT2gInyn1kHXW8mBKudH6FdXfGoz3b2U2gL35sRzJzYvyPTwPqa-cqOfiD_RoXLK5k8mArWa-QqysHIFVc0aMZeVqml-iofR5LFHBm8yg8_WAOh0T9ip92eertcRWfaASVbPuI3IQfS1Zv0ARZg_3oMl_Eucgir0ONN5PNmlSRL8nYs&cry=1&dbm_d=AKAmf-Bma5lqlHewHTqrxkrrBKsXU2IJlCK9tGsuCAmHRg7g23vXpKNF1384SZcVx4hom3xaiP88OD3MhyX53hvS8Mn2fgCUXDgOtFGrqkJgDDDTC3iPCvopOeONsd_w-DC6ElKSlaX-JdQp_U5ikdATOV_lFgmOxhfBS1HHkEH8e11BIpsTCyUJQ7S4_cO4qnQqFka3_EYMwmiVNGMRd2RqmP4ggmZ_OpPPBGVl6rCPl4SqpXM65vLwCxWBtlr29NM7Oz29oWEOWC06_0nQEsK-SoJFaPfNT_ilitOBT8Odg9zwZ-ok--mNfGGFvkNTWumziAsFASaOTv9pXNPPrDpTo6392bnb8p2ez8SXpWFhqnbJ_7HGY4gcrGgdHynaMzE6e5nLPWZR0CQ5lCWfxwHGbrWEbWqiX32ArL6LotuvMYjRTzFHIh2QDcQXqhk9P6ZanoX67ZWvnBJwyeuApF-4pAmu73GAJkJMkZN7CkB6Zh9cOhMjwX3Lsa9gvhTQUaP_103JGjZJUVGFyKQtmN1evPluWzKq6hYMeSOSvPjaeGqveVPXNKlyg-XCfcVLWJKJcAtigE5E-q5RLxudTjdLn4bM3Bzl-GC0KGGfGDDL5d8etVlBL_98z6qlXyRBw6NTwkjqjd9qJwW0oDj6H-mkPSSQJdymK1nGvvweWdwBgmLYTuu_Ww03o8K6b6hptP_DAPno3Tv03smS88mO1PaUac-cMJxxTBAsJI9Isu26hWPFHlMr56niTlN0br4BKEN5dzLmYQM00TGOM3qh1IfcHtSurfKEubL1ruSnww5o4Dq1eHYhkLc2WqX6AHuax8Jp2KZFKF5Kl3eDEO8rgMu0J7AfDEQAuj8UNTtkiNGy4QZG-wvmmIRy8oNdBhlOu_-ZhUFNDkMQ4OZXTZoH0gO44lx1H33arTUDQ5K9OC-uEGbCeVA2QAqVmnzj1RkG3wimAnwy8ahiGXv5s3EqD2vtlHo_LAzZ9nAag-oJewRVPxNq_TIrtSmH8qIRI4jzidv2NfZUPwOP_sHu3qWwLuzelCij3xXmyFC6BVqFWiMcEyNyFunmeQDTB7DO2oJg8ptt389UF2sKTYViX8jXzKgcmwW3Rdhvgusuyl9-0g5fr8W7tK95KhRNVa_JPsTYEr1yCr95lQSDN63AWQE_edg_A09V8_kixcunRqY9XiLRPoHEXR5prFzTJIxBBbD0Nzjr2nz_cjMQlEg5xh4_3aafDTuK4-0h8OsBiO0L7I8yhE6XPPO5jhfEdSzIGYw_RY7JWp6B5gvKtdbkPo5SqIROYEHWIo7I2j2c_Vr9inih4WWGUeO6an59KWegPGxYpZlVqEiz8SyFbl3GL13nMAvAEn4PSXzG1ApWOyXJpnHn7kL413BK5FUlC25pAs8aDtwTskWEC6S6-ob9wSuXZv6MtQSa7wK-Fvz31A8quEmiIO_K2oasacJiIumcyIGLD9D5-VQiQupdIGEPyKeioMdd0qh5Ek0fr5xBQ7TgRTeVI2LyfhY0aNNqPZhIVtGAA7no_q8pyemYQRvR_MiCwHzX2xeeiQlB8LA5D8M1o2lh-IA7mbh_8e_41iDtPkftaYC1acUhjpyQavycc-sXFygUxwbbmdiQwruAG8u3KByqcyNR23Ke_R0ACz_YkNRgPsesU__u9EIFTgJ1bW4hewhUDSsPCjc_0MtDjACB7yHs1RaUmAjUd5HM2uUNcAmhsuCdgDWmOMa9L_Kxsf6NDKugLsUUpH3f1POd7qPKS0D_hyDp-3GiC7kGbHbWddT8gj-Ra_td_lLO9px6pSJfgcZ-7-Up0ybt8jkunOqAm0wcMsvSbXMzHKAiigWYz3tBHUPFgm4zJvu6fFJYqhWm2zgbFGuYvcBm7ZdrUtZljl7xIj-9vmAhORz9ZbTJS0nGvaDNFOTfFTF5rseLBUV17SpDGEPtWtD7n3kLpFHzYoqx4Tqlv7BpSmxMmRYwcS9KABh1qbHJ-AgVXzY-KXFQf6dgnE66UAlnac54dUP1_uxbs2EAOBIr_VA0aj-r5e2pUgeBFbtP9jX7e2NR8x3l7VcemqrhmuUrRfg7AwBlShCaY407xGVSnyfDXRWSpAG9RIcB_L69j6uhsqnpZPRu8eTXU7Zd2jZzPtkku3PxE4pOJ9oAfRQSgrHacG14UWNgdxKZKS-8Spo5oM_qB441Mrj3CyQm8mMrk7M7ATXNJt4z9achaA2cuDCdnUEiQxLgfF-AaQTV7y-RqY7Cz-ZYGskXv_Sas_w_cw-n-6f0EO9o5uEhNOBRgjhqIbhBTphEOKdZEXofZ_PcRYtkm58p6WeyBLErTsLOjqe7Rkm8q3onRgSP1ND1Se_fq10sXVyptlPBD6E0Uq_TZ-PED3aNI9uk-feVoUiPK_9g-i3q9g19_vcy6tM4XJO9YbdI0U9OTqxKvpO0F7H1weNPOGyou1Fmqd0ChFFJmPhgsCWzRbNECnx8nKkbR238h04-G9VAJV1t1YmID3jKIWf5M_kvqHf_TgCewsqjfKrfQQLAzBApghWTRmhAk3qhwd-HfFY6IWCC-loqYuIrDOlecZPmwL11vBUtJFyjoTND2gVkWAEBQEnfwn52PXx4W3w1R0Kfh4d3sFK2WzDSyYkNEzl7sYo5xUt1HY_in-gCev4yC4S_nzjtArGOdSX08Q05bycDIajWqIWSjm52qWMA8Zx52eGVmhDQfH498maPDtmljtTOQHDVTJIBlCh6I1DyTmKxLOofIy36TlYhiu9KAM5JvhlFITP1wazosP0ad0nTII_3fnJKCO85WP5aXNDrr2lciAQdwVv5fLTnEUTnpxi9gNimRjbA79pxIYm71RvmldsF3OxzLz3Ydj7snd1MxxUb2gHoyiNSxUJZDu0JFLxxevzMoQhZg_dBcjPAtKLMHp_4N1wmLZymi7FvfQpbm3QdQdrqQiK3VveUpkYHSYy7mCWChZabMCh-EocmHtmESC9uIIVdKl2CO5AF5UIn-SCiv8VU6PoW4bWjEy328TPH516KPIXj2PEvoxSQofYE0M9sg_1kexyXoAhWXLFbhNtbtK7G4tS2Uw_2Ek7fHaCoMwzSh2kCi_vlRRgzzrSqESJ2zOzi--kvrBC9UwGkMb_Jqzi40kg_mW8ktbIYpQmjmHg9XQ0haaeSXxqp3dIuosP51yWgK7plcga9asqOGC3NrRmNtF2RhYs4hM4qwhgtpSRY3D1lqb8gzVvrrlonktOlxK0b416wFgTb-9YS-4rYojQfPtrtYQLBIoS6Iu9z5uElu2GXDS081e5fxamMhNVLDgdzaR02eFuuIjwwuW2-4iUGlbfCM3-L1zIDgRG_1RklYdyVqwi9yexyselN9jebhDubdvjCEPiQYYJG0FXkMyG2crA6DeBwJJGvOSbxoDy04b3Z0L6ErVrZmkCPUJ5_XrBCQSuRGKvGsptGkyZyaK--KQdg__7pJHUCM_XQ1y1Q_GKO8yTFuAqYJwrgi5tKVaVjpiXmd4G3SJsBHcyxJCw3Ms6X-hTKQyCbi9IVzTj2lfzORQEL46_dcrueCRWHVf4L-NeUefZwe2gHfJwpMfPLkhOPBawa8vOk2B66trPOI5nldfI7z8oaDFuhZ9vDclS20b8h5-Q6pSgQJL17jtbqbaiWvKL_mr4ttvuBrdZUxwl2ppIiadzz6JnJXd9J3fOCSe6-WOV-ZY0mchjTj9-OxrE-GGWTbl0ugsmzykXJzZ25bLR3cQC_wD6o_JOn5Duk1g8li5UeJjwNR-LukDSGJAam03TWRSWU6195aIOug9WcrBsGvKVU8u-_vdxlFihZ0K0GzXwse9YAqcBwKI5z9RFESOUd_sP44fQUDcvAOay9XtkhRQW3w5Xe6aL2LgWZNRqVEKW1huznJ0X1PBNtFHnE5t1hW56gvRGoVhMJ6_4IkyDKtg&cid=CAQSOwDICaaNaD4rVKmG_yFKPiMOj8xnzaNmsNdlhquqkxrhHP7mbOw5vRcXvU3foJ9DxKr8-lgmd7droN5mGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.balatarin.com%2F&ds=l&xdt=1&iif=1&cor=1154606877951486200&adk=1761367587&idt=76&cac=0&dtd=23

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8addc6dcf37a5afc07920bd30497d2948bbd912f73af9fb44bc7dda4ce1fd864

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13669
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame BAA1
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1&google_push=AXcoOmRX_bglT8Hy8uF8xhrILrrVSTgOt88dsWgEzV6LW8fajV989Llt5cqxuPraCNdewbnQ1v53CqrTBHNP5SlYiD87xC1xTArDifw
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODU3MzI5MTgzODEyMzUxODkzOQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1

43 B
398 B

16ms
14ms

Image
image/gif

46.228.164.11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: H2
Server: 46.228.164.11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame BAA1 0
104 B 97ms
23ms Image
text/plain 2a02:fa8:8806:13::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEGi5a3BrzpXdNnSXUR-EXQM&google_cver=1&google_push=AXcoOmT9QpUF-HgTZXYaS9sN3rZ52UPxRf572L_X3VW1hmR3AHiNC3tkqMscKRpqm-iwuQTJr3vHYms0dm8WRoM6GOJga4Iv-epI5g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=5688324856&adk=4223602507&adf=1525804284&pi=t.ma~as.5688324856&w=336&fwrn=4&lmt=1699037883&rafmt=12&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&efwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882793&bpp=1&bdt=359&idt=314&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=243&ady=200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&xpc=RSslOf47GR&p=https%3A//www.balatarin.com&dtd=317
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame BAA1
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEErABbT47IFkkg41oFSJi84&google_cver=1&google_push=AXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq9O...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEErABbT47IFkkg41oFSJi84&google_cver=1&google_push=AXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq...

43 B
451 B

175ms
164ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEErABbT47IFkkg41oFSJi84&google_cver=1&google_push=AXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq9OwA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq9OwA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=5688324856&adk=4223602507&adf=1525804284&pi=t.ma~as.5688324856&w=336&fwrn=4&lmt=1699037883&rafmt=12&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&efwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882793&bpp=1&bdt=359&idt=314&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=243&ady=200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&xpc=RSslOf47GR&p=https%3A//www.balatarin.com&dtd=317
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8206d8b69cdf925f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 417
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEErABbT47IFkkg41oFSJi84&google_cver=1&google_push=AXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq9OwA&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQclZAMY9HvX2AP5xprMX0fIblaBzVGZhaXhVoSRkz9XTMCOxNeyCajCfnmP0VS4UBiZjLF-V0WXyY4IYE_Qu073nLX7mq9OwA%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8206d8b53be2925f-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BAA1
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEAH5JD5D5Pz8eaW_mBNnb5U&google_cver=1&google_push=AXcoOmSzEA-jsHbputFkI8TdS-151QoQJSIr68Z5AdUScwGoKxJxdUe4YoYXtYsGPJ-ogQNOx_sEqXnElKapAJKwBLL2skcQe4_ViA
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6DB76898629746AD8BFB9AE2347F9B67&google_push=AXcoOmSzEA-jsHbputFkI8TdS-151QoQJSIr68Z5AdUScwGoKxJxdUe4YoYXtYsGPJ-ogQNOx_sEqXnElKapAJK...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6DB76898629746AD8BFB9AE2347F9B67&google_push=AXcoOmSzEA-jsHbputFkI8TdS-151QoQJSIr68Z5AdUScwGoKxJxdUe4YoYXtYsGPJ-ogQNOx_sEqXnElKapAJKwBLL2skcQe4_ViA

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 03 Nov 2023 18:58:03 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6DB76898629746AD8BFB9AE2347F9B67&google_push=AXcoOmSzEA-jsHbputFkI8TdS-151QoQJSIr68Z5AdUScwGoKxJxdUe4YoYXtYsGPJ-ogQNOx_sEqXnElKapAJKwBLL2skcQe4_ViA
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 02 Nov 2023 18:58:03 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame BAA1 43 B
146 B 29ms
7ms Image
image/gif 3.126.125.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESECj_6MNqJUCN-yg-Q6bGAgY&google_cver=1&google_push=AXcoOmTmOoYny1bwQGIyvBDLlgetrs0H1BWolVSyY5-H8_4_32ZRxfmmWl-Z6EJwMOIAvNer1BTr6tWn95NXKWDv9pvZwAsmHEsE_1U
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=5688324856&adk=4223602507&adf=1525804284&pi=t.ma~as.5688324856&w=336&fwrn=4&lmt=1699037883&rafmt=12&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&efwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882793&bpp=1&bdt=359&idt=314&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=243&ady=200&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&xpc=RSslOf47GR&p=https%3A//www.balatarin.com&dtd=317
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.125.13 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-125-13.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BAA1
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmTqpBGs_e4VRYTMR2sb9tM8xJ_v9Ax10jWkvWK3L7lxJY_n7ejMgSEqUJm_ZXCzPzU7bVDExX0j...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmTqpBGs_e4VRYTMR2sb9tM8xJ_v9Ax10jWkvWK3L7lxJY_n7ejMgSEqUJm_ZXCzPzU7bVD...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODE5MTI1MTgzNDE0NzY5Mjk0Ng&google_push=AXcoOmTqpBGs_e4VRYTMR2sb9tM8xJ_v9Ax10jWkvWK3L7lxJY_n7ejMgSEqUJm_ZXCzPzU7bVDExX...

170 B
188 B

19ms
18ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODE5MTI1MTgzNDE0NzY5Mjk0Ng&google_push=AXcoOmTqpBGs_e4VRYTMR2sb9tM8xJ_v9Ax10jWkvWK3L7lxJY_n7ejMgSEqUJm_ZXCzPzU7bVDExX0jzWHBFOb_XZmF604D8tbVV38

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODE5MTI1MTgzNDE0NzY5Mjk0Ng&google_push=AXcoOmTqpBGs_e4VRYTMR2sb9tM8xJ_v9Ax10jWkvWK3L7lxJY_n7ejMgSEqUJm_ZXCzPzU7bVDExX0jzWHBFOb_XZmF604D8tbVV38
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BAA1
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESENMNKuGT5MRjMZ1ins-XRvE&google_cver=1&google_push=AXcoOmQs_QhiT7o2JbVhQcM0hYQiK-mvHvNx_FVaRVDGCA54DhIUrdQZH7msv4EPRi...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQs_QhiT7o2JbVhQcM0hYQiK-mvHvNx_FVaRVDGCA54DhIUrdQZH7msv4EPRiNPk5rJmHuLWEvNTIRnY9N3lczCM2L2EixzD0lD&google_hm...

170 B
188 B

21ms
21ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQs_QhiT7o2JbVhQcM0hYQiK-mvHvNx_FVaRVDGCA54DhIUrdQZH7msv4EPRiNPk5rJmHuLWEvNTIRnY9N3lczCM2L2EixzD0lD&google_hm=zNwqWMetSb2JPYHDvN4i74U

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:02 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQs_QhiT7o2JbVhQcM0hYQiK-mvHvNx_FVaRVDGCA54DhIUrdQZH7msv4EPRiNPk5rJmHuLWEvNTIRnY9N3lczCM2L2EixzD0lD&google_hm=zNwqWMetSb2JPYHDvN4i74U
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame BAA1 0
59 B 20ms
15ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JfYE7n4zVNikkTYQc9QxhaTCjTdthdPkRhc2VlNtUqXbnyIatFfeAHkxlCZiarTq1GN4YymQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame A2D8 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11684
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 15:43:19 GMT
expires: Sat, 02 Nov 2024 15:43:19 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 93E9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

43 B
736 B

25ms
24ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXYPb_sOKSACRhHLm0JjsYxcLTjksKi1Nm0aYe57d0USm_hiUc7Z9ewoERlVSJDShMWzrsr_vnfDnqsscLGJ2znzc52GJsr_3eaRBjaFB9GbQv4MWRkVWntpDIVPlJst1J0nUfc35W9nP1ZyQ3MU_0YqplhcXwkT3M-S8PoOMKg9XOkC_s
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SVZom9xupz4dces7leAqpw%2F5nWQpDoQXwwF8CAO4avU13YGrbxbyJc0LYp3Dq1nP9XpGhfR%2FyiqZUUG559UySSQfJy2TXPG7%2B8DbWdiqGykc2%2Fk2rcUoZh24bL%2FjczSYH2kXZMNiIxgdJw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8206d8b56c0b91fb-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 93E9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUVCu5HZvqm8cQ5tSTXXTgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1

43 B
736 B

20ms
20ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXYPb_sOKSACRhHLm0JjsYxcLTjksKi1Nm0aYe57d0USm_hiUc7Z9ewoERlVSJDShMWzrsr_vnfDnqsscLGJ2znzc52GJsr_3eaRBjaFB9GbQv4MWRkVWntpDIVPlJst1J0nUfc35W9nP1ZyQ3MU_0YqplhcXwkT3M-S8PoOMKg9XOkC_s
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OTayCApxGHPKOGQBlurtoeETd8fS%2BIgwwyW8F%2Ft92PXeOasg1%2Bxe8cu8ZXSbesg13PXG8zXbjmkt8aSzadCXpAmssKHezn7omgDMDRdwP%2B5SRnYly%2FcrhqjkThfcn0QRJ2z9F3Gy4%2F1W3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8206d8b5ac3591fb-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELHrxDfE6MTcSyG2EGYVIK4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 93E9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1

43 B
841 B

14ms
14ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQm8iDzQIY4rfV5gEwAQ&v=APEucNXYPb_sOKSACRhHLm0JjsYxcLTjksKi1Nm0aYe57d0USm_hiUc7Z9ewoERlVSJDShMWzrsr_vnfDnqsscLGJ2znzc52GJsr_3eaRBjaFB9GbQv4MWRkVWntpDIVPlJst1J0nUfc35W9nP1ZyQ3MU_0YqplhcXwkT3M-S8PoOMKg9XOkC_s

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
an-x-request-uuid: 8a04553b-2d6d-471d-adec-2a0de4345594
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEP5h11km-paw_riSVrngmZk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 93E9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
an-x-request-uuid: 064589aa-8325-467f-9ece-46a57e89dc6d
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc0NzUxOTY2MjY3NDA4OTgxOA%3D%3D
x-proxy-origin: 138.199.38.133; 138.199.38.133; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 080D 134 KB
34 KB 32ms
18ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28d76b4a4ec9614dc564bef56c3ec33515fa57b82066b06b9a06bd248a9ddb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
expires: Sat, 02 Nov 2024 18:58:03 GMT
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 19A5 0
0 88ms
54ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvcd_i-853BqfKR6aHG5WBj7F2EVxTOEHvJe33wGeVeA8Cd91Cq9PHiIovjWdaApxM1bLy1aMVijHv0u3fKMzK-jqWSIAJSqvLL5VlvHuZiyv-lLVLojvSnw3FeDzVnCZg4MDN01KfvbC34EfMJZccvmrpFHQNPNd8bFVuY0TsUsj-BkR0iQ-w8HWTsNEwa936jq1bQjhhVyakJrCfxHIILgLe57C4CEoKSDz2gynE9DhfwQuXfkEf4ocj2QwFDsjHTdDWz7kIyh73dxuhfTapCHMuft3xvd9Tl3rW88Os8xfEpEgQ5m897cmri1d9u4U5dob1_7tMHKsHu2IjRU4MFYFymOHAEcFpbTz2XVcd1_KE8QekK0QlrqX2qMsJY5F_GZ73UtZN-zsHaUs94FDKnQHt2PuGv350ra69bsb-J4BWYlsDO5nlS8mjcR7ppk2bnFhNOCKOyfDqiH6pzI3rmlxeE_rXTBC8m-KWZgwwcV6fqC6oi3UjWMU3tChylFWe2xmFDn-Fy-mWY7tUoGeeA0WSJ4wqNMRg1oGo9_87gqUeZfCWRiIJyAT-Q1Bq_rJcvCXdZWX1uHpXgGj1uAXK-AUtNyeCRH6eQmH6-HFMbGRWZNWkS6xQYOOXDzzibDb_fxO4-edK8RIeqDURFvnYhSRuX1L2yktA1Ez0bChmK8o_qneInpBDRqDYCI3SSX-9aoOxfFE7WOQjzw_omF2OCfbPqIdXsWw4rBGkcKWci9XkQQ5rGF4kLlDf6fATxEB1Nq3lNhamay1ECIxAQdrc0UTpr_eUgEtGOzsXvcmEcO0IPJo56czPXBjYKIPDddYUb5YgcOzVFdhEWxAo1Pd2GQ8OzVaqKIjO0zL5ZUD1D6QpbfTWXbDFWHGckVTkvgfGEE1WZsS-T68wIc3iQY5I4iQhSTM8Adn2WbPMjgwz2hig3aOUu-o8nk8pll3AyM03fbwKvbnW8L7g6XLjCuqqdzyfrfN2eIWt6HO1NFU53CdbUZwLXgXriQYAssHkdmHVgU4DF8wQ0aWsMeaIFuniGURJWFp458ywRekQ6qqEXNK4QE434Vbk1aqhfbrI0a66OuboYgQc78iym9ycoRNnPdswUTOs0x5l64T-ChLbiN2Qi1xItt83Wr9frYiIzuTVxWO8KTsiLDhtc22UhbEU0QRlHICibKJo82gUea1sGhzSP_ERS8P3olllu2AVyDZBiIhptsbYi359uyHFeX6GK7XCLvQGsODDvXAaLjcrBjnsf61Cp7N_me43ffauNkHROCz-YU-7ixJUKZRXnCjEyqSHb3uOg1HM5trTF7-1fBYmjai6K6Q4mIaI2o3PONYLO2dYnU7huHK2Y8VFOuG6Mqc0z_ATslJXgwdbceolaWoFpHC5oEmMm5Jfk0uJPHg&sai=AMfl-YSKGCR1qXX48aBsIaMxK1Zvh556uwEZcXx1vnHG2RwDuPCJ6z_E6BM8YRBVpqRMe4I5suzb-8nMqe3d52dFgbU-sEHG61E3Wyd-il_HvDyBbCObshwKqug2TrFX_8Ar-x1X9-Bz4aWrsE2DQlHkNy9O92X8bAHSK6UiLvR9JQmEPdINu5gf_A994fWE3Vvc2k8T_cSAz4ZYQ2rtWHhIeXfR7zWM9ZGFDaKHjABuofHo1MarySAVHjcr0a1H7uVMk_tYJxQhJTLSIZyIlOaoXgaeKJ_wLd68JK25E2rOpQqQYudvUqU7h-NKcDz8BwnqPp3GSh8Rn5E5ZyWR5rUT5KNLz4kyptqHOFDEL_VAt7g1kkzbJIW6jsmk5tAitmP3MMEDZwkHQlokjBzjtWcGwwrd&sig=Cg0ArKJSzAAH89Jmh22_EAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=194&cbvp=1&cstd=187&cisv=r20231101.85281&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 5327
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1&google_push=AXcoOmRJxMzhcLnSCheBninu09Jsxfp60zVt6tCwcx4f4wh81rTviiR7ANWuKX0Sip_GzF5VN0pYNt7n3AiAh_DtlMV9l3PsqTCrV...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjM3NzE4MzE3NTc5MTg0ODQxMQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1

43 B
398 B

15ms
14ms

Image
image/gif

46.228.164.11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1
Requested by: Host: www.balatarin.com
URL: https://www.balatarin.com/
Protocol: H2
Server: 46.228.164.11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKExVObxqWXhJijHg8zpKLY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 5327 35 B
464 B 60ms
31ms Image
image/gif 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESED6gyHFQK6nUTy64tItfrHM&google_cver=1&google_push=AXcoOmSxFhJcKSfYqAo1wHEd0Ae4evoJyIrxEt1MPwU3XsfWMMYBz_5QgvMCyJWZu5AbRyCJkI1d2wi4m6t0NhUSWIE6ePmROS-4HQ5yZ17L9-IG8uh2MTPVxJiZfbjUWu3oenXDpMbnBuxA5Wvjv7LPHUa1Tew

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5327
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEAH5JD5D5Pz8eaW_mBNnb5U&google_cver=1&google_push=AXcoOmR_CZa64zdqD1SRAOHLY43hoMYbyzbJkLXqUHwt_KgpI52q-HCmmNB-cY0aq2z-_JSXpsPRX5W7wn4X-L7UN_vqpWtE5PPCET...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6DB76898629746AD8BFB9AE2347F9B67&google_push=AXcoOmR_CZa64zdqD1SRAOHLY43hoMYbyzbJkLXqUHwt_KgpI52q-HCmmNB-cY0aq2z-_JSXpsPRX5W7wn4X-L7...

170 B
188 B

20ms
19ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6DB76898629746AD8BFB9AE2347F9B67&google_push=AXcoOmR_CZa64zdqD1SRAOHLY43hoMYbyzbJkLXqUHwt_KgpI52q-HCmmNB-cY0aq2z-_JSXpsPRX5W7wn4X-L7UN_vqpWtE5PPCET6d4EEWLBZk2nSx-2hvBG54crt7p_1IAQCrU7uqnAgofzjV0Bp4_Dt0E08

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 03 Nov 2023 18:58:03 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6DB76898629746AD8BFB9AE2347F9B67&google_push=AXcoOmR_CZa64zdqD1SRAOHLY43hoMYbyzbJkLXqUHwt_KgpI52q-HCmmNB-cY0aq2z-_JSXpsPRX5W7wn4X-L7UN_vqpWtE5PPCET6d4EEWLBZk2nSx-2hvBG54crt7p_1IAQCrU7uqnAgofzjV0Bp4_Dt0E08
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 02 Nov 2023 18:58:03 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5327
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEGf3p27gjoCvTQtJygeaqzs&google_cver=1&google_push=AXcoOmT2PPJ_27edLLBj9Q8QOe3afQY_WikH4xbc7sHbIsD7yId9EYejUIB65A6NN8rCOZLMU_36x62nwJjMr_eQ...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4svS1iKmRd4mgAzZ1W9h7w&google_push=AXcoOmT2PPJ_27edLLBj9Q8QOe3afQY_WikH4xbc7sHbIsD7yId9EYejUIB65A6NN8rCOZLMU_36x62nwJjMr_eQnW5xWhzRK6qCy5o...

170 B
188 B

20ms
18ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4svS1iKmRd4mgAzZ1W9h7w&google_push=AXcoOmT2PPJ_27edLLBj9Q8QOe3afQY_WikH4xbc7sHbIsD7yId9EYejUIB65A6NN8rCOZLMU_36x62nwJjMr_eQnW5xWhzRK6qCy5ofkYjYQxgRBzAXH0LpopHhGxjOomntnB13998ze--FsTxqlpt1KJ6qpUA

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 03 Nov 2023 18:58:03 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=4svS1iKmRd4mgAzZ1W9h7w&google_push=AXcoOmT2PPJ_27edLLBj9Q8QOe3afQY_WikH4xbc7sHbIsD7yId9EYejUIB65A6NN8rCOZLMU_36x62nwJjMr_eQnW5xWhzRK6qCy5ofkYjYQxgRBzAXH0LpopHhGxjOomntnB13998ze--FsTxqlpt1KJ6qpUA
x-host: tde-deliveryengine-production-bb588bf9-bhmr8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5327
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmSFVG4xf-vz_IPNPI2yywlPcKtw_rzim9j0bxYww5TqmJjt4-b1Bp7C4Ntv2zne9cPjJ_rN2ivS...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmSFVG4xf-vz_IPNPI2yywlPcKtw_rzim9j0bxYww5TqmJjt4-b1Bp7C4Ntv2zne9cPjJ_r...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Nzc1NTY5OTczMzczMjEyOTI3Mg&google_push=AXcoOmSFVG4xf-vz_IPNPI2yywlPcKtw_rzim9j0bxYww5TqmJjt4-b1Bp7C4Ntv2zne9cPjJ_rN2i...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Nzc1NTY5OTczMzczMjEyOTI3Mg&google_push=AXcoOmSFVG4xf-vz_IPNPI2yywlPcKtw_rzim9j0bxYww5TqmJjt4-b1Bp7C4Ntv2zne9cPjJ_rN2ivS_zHE0hxVGFlP9bsHftKs1_4rYDwyjDyGF6HqWwVHPMeRR-_3xsRSkM_eVbf5O9v20tKPZW42DMfMPoY

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Nzc1NTY5OTczMzczMjEyOTI3Mg&google_push=AXcoOmSFVG4xf-vz_IPNPI2yywlPcKtw_rzim9j0bxYww5TqmJjt4-b1Bp7C4Ntv2zne9cPjJ_rN2ivS_zHE0hxVGFlP9bsHftKs1_4rYDwyjDyGF6HqWwVHPMeRR-_3xsRSkM_eVbf5O9v20tKPZW42DMfMPoY
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5327
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEJFEson5bb-cckY1MYVXtI0&google_cver=1&google_push=AXcoOmRq6RwHRmrbLFFnbRaTz2Ikk0MAVuqrQrUKyMUE60Ha7a74pa-SFcRNTHTJ5H0ySelsvf45q2xHceo4...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRq6RwHRmrbLFFnbRaTz2Ikk0MAVuqrQrUKyMUE60Ha7a74pa-SFcRNTHTJ5H0ySelsvf45q2xHceo4l1uOMBw1eAK-wl4rHXXxUpuAEgaeTaq3OdLV...

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRq6RwHRmrbLFFnbRaTz2Ikk0MAVuqrQrUKyMUE60Ha7a74pa-SFcRNTHTJ5H0ySelsvf45q2xHceo4l1uOMBw1eAK-wl4rHXXxUpuAEgaeTaq3OdLVECVml2ABRzxEHa7TbPZEedck1hsyu8frkCqOJg

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRq6RwHRmrbLFFnbRaTz2Ikk0MAVuqrQrUKyMUE60Ha7a74pa-SFcRNTHTJ5H0ySelsvf45q2xHceo4l1uOMBw1eAK-wl4rHXXxUpuAEgaeTaq3OdLVECVml2ABRzxEHa7TbPZEedck1hsyu8frkCqOJg
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

report
sync.teads.tv/um/ Frame 5327
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEOtN6WeAPhcT...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmRf0I3fUHxxifvtvi1lxq7A2fI3mobdy4P_B1Zr8O0h41Pkwu88IolI58Uh2Zk7K2SMJfdTjnJa3mxCmNEe-sYEgCq1asQbpJkA9vxqL0E8LI1wK...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

38ms
38ms

Image
image/gif

23.43.61.33
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=280&slotname=8352827426&adk=3914965158&adf=2248382236&pi=t.ma~as.8352827426&w=336&fwrn=4&fwrnh=100&lmt=1699037883&rafmt=1&format=336x280&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882794&bpp=1&bdt=361&idt=319&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0%2C779x90%2C336x280&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=254&ady=1018&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CeE%7C&abl=NS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&xpc=gkPueaxurS&p=https%3A//www.balatarin.com&dtd=321
Protocol: H2
Server: 23.43.61.33 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-61-33.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

expires: Fri, 03 Nov 2023 18:58:03 GMT
pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5327 0
12 B 15ms
15ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JFWo_leRYMQLkglBPi38LLLZCFmtseZ4U2o9Pit2rhvUHv6ZqZhpbxPv3zaL4iu7XASeQ8gw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 08F9 134 KB
34 KB 16ms
15ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28d76b4a4ec9614dc564bef56c3ec33515fa57b82066b06b9a06bd248a9ddb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:03 GMT
expires: Sat, 02 Nov 2024 18:58:03 GMT
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2744 0
0 51ms
51ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsthUV4iyRTrcHwD_b8JsY6JW3ACrd8o18RxqfB-h5Qq7s1marE24B4cxUIze1I6F0pj0sLN9YXB8jtHrOD6JjUJLibMVflrAo2aRocnRJqkLsWnQJ3qSJbcDUmrQZncNtF0xHpXmT52mxUt0r0tT5Apb-UQI9E2dbf5TOgdlXzLYlbBOxkLpS8tbdgXZbv1cQUVS0nI6Ak8YXCmlIl30Ab9Mk5tngzSBNXP5SNX3cCBWtul1Utj1fe0EWrCmWYF9UDzHlIzME_r8XNnTg4YUay2vzTO1G7ku2tUHl4ijbhR5UVaxwjZqcNbZA_dNBhTE2E5XFHvpyYXYbhuEJvmXwKbqm4N8syh72Hc9wecHPL60AclhMXZQ93au5_obIONY2xvNSdJOfzZnb1bJbOddv-UmEoiKWcFvMXAnvHlZW3ph0Pzm65qxydLR1P4BTIdALcJTwpHFq4AJ538W6s1aFRxIM9pxLvUXh_Lt8lw6Mn_7ckqvF5fa4h419HHp__MII9gcbnV-LfsrjVVkME0GuNznG0bCqsYij6QReUf7lhO_7c8q4Uanm6fJv4iYPJPhwlH-IU7mZmWbIQoBXIws1d8ZwlKCP7vvxgrqqEX_oK3SW7PSN1O6zAYNw1Gh2PIxI5UZqwBYKG5Sz-SVocTocGPn__zFYSaFkax9c0T7Fd2N6dvHo0Z3nFugPIOobtqmxbAP_o9GDAtfAcPXZSwIFmeqMoGfvsXNk3Wv2C9C5Xlpg20zW9Xx45ivDCnFut9Q1smQjb2t1QWo65BpRDLGjq73yvUxsnQ0AwU8cRAUZh7shDhQ6_5ECONag9bHdqHocJk8BPduAfldFJRqcQNxumbWQDGOoZJEHadRUl4GwLJ__Cn16QsXbgigI4yx4vIVaSG6Jlk2Bb6ct5qHHvMfKHvbspK2acoGjXo2NCokN10LkxxBevAtRuHW9AmL92D9ib3NHvy6ZymBoabQBrGJd6nDIQCBCrHG4Hb9kWd7sycv6kvR2M8MkJrDrQ3gZW6nJku2pQ-mxCA7brhECfPfnrnixwtAcN5eDUH9-SBFkUqEC0U1Ciybo7caeJ9hotHj7yLNyPj7TAYSALBULGP0GDe_i_KZAQn4VUH3YsGDe9B6GlGFDSVUglEvmQ9qULeF6lH2mliJN4HuXoVvT1F-JxovZCmDfPou4m4KkIxJzYm4f3qizJ0V4dhLS92Qn-Nt4x2Cwvk2CH3w-VbfVLOoolyax7aasBDrVtefYMlXyQSfRtQVVcpj3i79CbU8QJiLx0cXUQZdRmC4xWqpExA_QS80PNFmULpLVfYT-VnwsFo2ZSFMoMViV5w4mLZbuskwV23U51lomUgUlyVfeaMXZNONPJIsqniI71RplI&sai=AMfl-YQ9RAGU0caIPIdcMLgEhVIAsf1aGKIqcL12_hQE_D2baP2hyN5Fh8Den9C8uNQDSrlAGJNEVItK1dtClggc13CdNWQysCEJ2Tor6vtbQtJUS2zELyz9y35l6Q4IEYCuKpXhl2PHQHhiR2ebdkkJBm3M6fEqMUIBbxoYezoessPYqO2v-l_J9i8IVJEEI0qqXlA8w8XE7sCJmKB6batWBMNi5D_cHt3lJaKO8XTGJkxPONHeYCu-VGLDotYjr0KsvRLTQXxJAb1cJXGaXpdak-pDJ7kezlhentlj8kQan_ph9SeCISfc6iAKIVKSvLi6N4LUki6IgiYS8GGTSSLF8MzgXF2hwJ7RuczvhQBgqIdUwKUGPIHV1aGid0DP3LvMoELeu2KotZ62hQmo_TdhtHVy&sig=Cg0ArKJSzEEbB11207yWEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=141&cbvp=1&cstd=134&cisv=r20231101.16554&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D072 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DjHT2gInyn1kHXW8mBKudH6FdXfGoz3b2U2gL35sRzJzYvyPTwPqa-cqOfiD_RoXLK5k8mArWa-QqysHIFVc0aMZeVqml-iofR5LFHBm8yg8_WAOh0T9ip92eertcRWfaASVbPuI3IQfS1Zv0ARZg_3oMl_Eucgir0ONN5PNmlSRL8nYs&cry=1&dbm_d=AKAmf-Bma5lqlHewHTqrxkrrBKsXU2IJlCK9tGsuCAmHRg7g23vXpKNF1384SZcVx4hom3xaiP88OD3MhyX53hvS8Mn2fgCUXDgOtFGrqkJgDDDTC3iPCvopOeONsd_w-DC6ElKSlaX-JdQp_U5ikdATOV_lFgmOxhfBS1HHkEH8e11BIpsTCyUJQ7S4_cO4qnQqFka3_EYMwmiVNGMRd2RqmP4ggmZ_OpPPBGVl6rCPl4SqpXM65vLwCxWBtlr29NM7Oz29oWEOWC06_0nQEsK-SoJFaPfNT_ilitOBT8Odg9zwZ-ok--mNfGGFvkNTWumziAsFASaOTv9pXNPPrDpTo6392bnb8p2ez8SXpWFhqnbJ_7HGY4gcrGgdHynaMzE6e5nLPWZR0CQ5lCWfxwHGbrWEbWqiX32ArL6LotuvMYjRTzFHIh2QDcQXqhk9P6ZanoX67ZWvnBJwyeuApF-4pAmu73GAJkJMkZN7CkB6Zh9cOhMjwX3Lsa9gvhTQUaP_103JGjZJUVGFyKQtmN1evPluWzKq6hYMeSOSvPjaeGqveVPXNKlyg-XCfcVLWJKJcAtigE5E-q5RLxudTjdLn4bM3Bzl-GC0KGGfGDDL5d8etVlBL_98z6qlXyRBw6NTwkjqjd9qJwW0oDj6H-mkPSSQJdymK1nGvvweWdwBgmLYTuu_Ww03o8K6b6hptP_DAPno3Tv03smS88mO1PaUac-cMJxxTBAsJI9Isu26hWPFHlMr56niTlN0br4BKEN5dzLmYQM00TGOM3qh1IfcHtSurfKEubL1ruSnww5o4Dq1eHYhkLc2WqX6AHuax8Jp2KZFKF5Kl3eDEO8rgMu0J7AfDEQAuj8UNTtkiNGy4QZG-wvmmIRy8oNdBhlOu_-ZhUFNDkMQ4OZXTZoH0gO44lx1H33arTUDQ5K9OC-uEGbCeVA2QAqVmnzj1RkG3wimAnwy8ahiGXv5s3EqD2vtlHo_LAzZ9nAag-oJewRVPxNq_TIrtSmH8qIRI4jzidv2NfZUPwOP_sHu3qWwLuzelCij3xXmyFC6BVqFWiMcEyNyFunmeQDTB7DO2oJg8ptt389UF2sKTYViX8jXzKgcmwW3Rdhvgusuyl9-0g5fr8W7tK95KhRNVa_JPsTYEr1yCr95lQSDN63AWQE_edg_A09V8_kixcunRqY9XiLRPoHEXR5prFzTJIxBBbD0Nzjr2nz_cjMQlEg5xh4_3aafDTuK4-0h8OsBiO0L7I8yhE6XPPO5jhfEdSzIGYw_RY7JWp6B5gvKtdbkPo5SqIROYEHWIo7I2j2c_Vr9inih4WWGUeO6an59KWegPGxYpZlVqEiz8SyFbl3GL13nMAvAEn4PSXzG1ApWOyXJpnHn7kL413BK5FUlC25pAs8aDtwTskWEC6S6-ob9wSuXZv6MtQSa7wK-Fvz31A8quEmiIO_K2oasacJiIumcyIGLD9D5-VQiQupdIGEPyKeioMdd0qh5Ek0fr5xBQ7TgRTeVI2LyfhY0aNNqPZhIVtGAA7no_q8pyemYQRvR_MiCwHzX2xeeiQlB8LA5D8M1o2lh-IA7mbh_8e_41iDtPkftaYC1acUhjpyQavycc-sXFygUxwbbmdiQwruAG8u3KByqcyNR23Ke_R0ACz_YkNRgPsesU__u9EIFTgJ1bW4hewhUDSsPCjc_0MtDjACB7yHs1RaUmAjUd5HM2uUNcAmhsuCdgDWmOMa9L_Kxsf6NDKugLsUUpH3f1POd7qPKS0D_hyDp-3GiC7kGbHbWddT8gj-Ra_td_lLO9px6pSJfgcZ-7-Up0ybt8jkunOqAm0wcMsvSbXMzHKAiigWYz3tBHUPFgm4zJvu6fFJYqhWm2zgbFGuYvcBm7ZdrUtZljl7xIj-9vmAhORz9ZbTJS0nGvaDNFOTfFTF5rseLBUV17SpDGEPtWtD7n3kLpFHzYoqx4Tqlv7BpSmxMmRYwcS9KABh1qbHJ-AgVXzY-KXFQf6dgnE66UAlnac54dUP1_uxbs2EAOBIr_VA0aj-r5e2pUgeBFbtP9jX7e2NR8x3l7VcemqrhmuUrRfg7AwBlShCaY407xGVSnyfDXRWSpAG9RIcB_L69j6uhsqnpZPRu8eTXU7Zd2jZzPtkku3PxE4pOJ9oAfRQSgrHacG14UWNgdxKZKS-8Spo5oM_qB441Mrj3CyQm8mMrk7M7ATXNJt4z9achaA2cuDCdnUEiQxLgfF-AaQTV7y-RqY7Cz-ZYGskXv_Sas_w_cw-n-6f0EO9o5uEhNOBRgjhqIbhBTphEOKdZEXofZ_PcRYtkm58p6WeyBLErTsLOjqe7Rkm8q3onRgSP1ND1Se_fq10sXVyptlPBD6E0Uq_TZ-PED3aNI9uk-feVoUiPK_9g-i3q9g19_vcy6tM4XJO9YbdI0U9OTqxKvpO0F7H1weNPOGyou1Fmqd0ChFFJmPhgsCWzRbNECnx8nKkbR238h04-G9VAJV1t1YmID3jKIWf5M_kvqHf_TgCewsqjfKrfQQLAzBApghWTRmhAk3qhwd-HfFY6IWCC-loqYuIrDOlecZPmwL11vBUtJFyjoTND2gVkWAEBQEnfwn52PXx4W3w1R0Kfh4d3sFK2WzDSyYkNEzl7sYo5xUt1HY_in-gCev4yC4S_nzjtArGOdSX08Q05bycDIajWqIWSjm52qWMA8Zx52eGVmhDQfH498maPDtmljtTOQHDVTJIBlCh6I1DyTmKxLOofIy36TlYhiu9KAM5JvhlFITP1wazosP0ad0nTII_3fnJKCO85WP5aXNDrr2lciAQdwVv5fLTnEUTnpxi9gNimRjbA79pxIYm71RvmldsF3OxzLz3Ydj7snd1MxxUb2gHoyiNSxUJZDu0JFLxxevzMoQhZg_dBcjPAtKLMHp_4N1wmLZymi7FvfQpbm3QdQdrqQiK3VveUpkYHSYy7mCWChZabMCh-EocmHtmESC9uIIVdKl2CO5AF5UIn-SCiv8VU6PoW4bWjEy328TPH516KPIXj2PEvoxSQofYE0M9sg_1kexyXoAhWXLFbhNtbtK7G4tS2Uw_2Ek7fHaCoMwzSh2kCi_vlRRgzzrSqESJ2zOzi--kvrBC9UwGkMb_Jqzi40kg_mW8ktbIYpQmjmHg9XQ0haaeSXxqp3dIuosP51yWgK7plcga9asqOGC3NrRmNtF2RhYs4hM4qwhgtpSRY3D1lqb8gzVvrrlonktOlxK0b416wFgTb-9YS-4rYojQfPtrtYQLBIoS6Iu9z5uElu2GXDS081e5fxamMhNVLDgdzaR02eFuuIjwwuW2-4iUGlbfCM3-L1zIDgRG_1RklYdyVqwi9yexyselN9jebhDubdvjCEPiQYYJG0FXkMyG2crA6DeBwJJGvOSbxoDy04b3Z0L6ErVrZmkCPUJ5_XrBCQSuRGKvGsptGkyZyaK--KQdg__7pJHUCM_XQ1y1Q_GKO8yTFuAqYJwrgi5tKVaVjpiXmd4G3SJsBHcyxJCw3Ms6X-hTKQyCbi9IVzTj2lfzORQEL46_dcrueCRWHVf4L-NeUefZwe2gHfJwpMfPLkhOPBawa8vOk2B66trPOI5nldfI7z8oaDFuhZ9vDclS20b8h5-Q6pSgQJL17jtbqbaiWvKL_mr4ttvuBrdZUxwl2ppIiadzz6JnJXd9J3fOCSe6-WOV-ZY0mchjTj9-OxrE-GGWTbl0ugsmzykXJzZ25bLR3cQC_wD6o_JOn5Duk1g8li5UeJjwNR-LukDSGJAam03TWRSWU6195aIOug9WcrBsGvKVU8u-_vdxlFihZ0K0GzXwse9YAqcBwKI5z9RFESOUd_sP44fQUDcvAOay9XtkhRQW3w5Xe6aL2LgWZNRqVEKW1huznJ0X1PBNtFHnE5t1hW56gvRGoVhMJ6_4IkyDKtg&cid=CAQSOwDICaaNaD4rVKmG_yFKPiMOj8xnzaNmsNdlhquqkxrhHP7mbOw5vRcXvU3foJ9DxKr8-lgmd7droN5mGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.balatarin.com%2F&ds=l&xdt=1&iif=1&cor=1154606877951486200&adk=1761367587&idt=76&cac=0&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:17:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16804
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Nov 2024 14:17:59 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTY5OTAzNzg4MzY5ODUyMwogIHNlcnZlcl9pcDogMTI2MDU4ODMyCiAgcHJvY2Vzc19pZDogMjA4MTAzNTc0MQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame D072 0
856 B 81ms
42ms Image
image/png 142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTY5OTAzNzg4MzY5ODUyMwogIHNlcnZlcl9pcDogMTI2MDU4ODMyCiAgcHJvY2Vzc19pZDogMjA4MTAzNTc0MQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMjg5NjUyOTA2NjEwNjYzNDE0NwpkZWJ1Z19rZXk6IDgxNjI1OTM3NjM0MjI1NjE0NzUKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTAzIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzQ4NDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwODYzOAogIH0KfQphcmNoZXR5cGVfaWQ6IDEKYXJjaGV0eXBlX2lkOiAzCmFyY2hldHlwZV9pZDogNAphcmNoZXR5cGVfaWQ6IDUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDc1NDk3NDcyMAo

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xef07fb8b27ae1f750000000000000000","3":"0xcb56ff930daccb390000000000000000","4":"0xdce831727d8b9dca0000000000000000","5":"0xc61b0c028e53279d0000000000000000"},"debug_key":"8162593763422561475","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"12896529066106634147"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame D072 11 KB
4 KB 45ms
12ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1699037883246179&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAL-Lu0JFZaODD9KumtUPv-QppuW9oGmFlZynyQ_wLhABIIjO5BFgleKQgqAHyAEJqQKP2hbrhNyxPqgDAcgDmwSqBKECT9BWG07Q6ZIOKZeLkIiavhd157-G-kk_xy71xp3vfG3zyXpUAUeC0fQjTdFvSa6KXHAor54vevfofuX6C0bXcFYLb9OFyJ345ej2t5JKxRafDxYXKXRhj6tXj13XUvJKXFs2xC9ajDJsb97RYyQ73Uqe-6N-YWMiRfL7qI-VvVdSBi5e7PNAaYHESLObJEECi3vcFw9SmYkVvtBx8lyJdYKEvYp9ktLe_6BhLghKliuMT70B_lO4MBdo95C69IKp7uKtABnLOKvf1RqiIDUEYqeNQMpahQhuUXaIeOQ3QbkscTXcUP1v4g_uLvO-zTA38rAGAim3ysf1XqmIlouZ35AxY2Mnih6afZX_CKVoa0dCXOsqbUSjcfWShDIzHICyrsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNaD4rVKmG_yFKPiMOj8xnzaNmsNdlhquqkxrhHP7mbOw5vRcXvU3foJ9DxKr8-lgmd7droN5mGAE%26sig%3DAOD64_2LI_VVFVXM9iKmmMFK_C0zEQw9yQ%26client%3Dca-pub-7031645305449270%26dbm_c%3DAKAmf-A9l9y5h-Ug6uUPjy_F1rio32W5AO3FJmJuvkkLIewWF8oVtbT4ctdWlN9nwtAj_H0JS0I9vszvEouVlZfaZVGYoM1B08mzI6XTBQQT8OdIwhJbMU9zQhfM_IpAKJTrdPf25rqRhsB67ECT00r2Y9735b5lj_5Yzr7TgN5Y4X6wcYZdxkU%26cry%3D1%26dbm_d%3DAKAmf-AgoeOCClwj_P2E61ATD31bqvSw2FfQT37SxfEu7E2Bq-QkqrB_DL6ag2MwM57u6un1euK4c9HOeXXoFTQCeKeOu2g3Euo6eCtdueXB4DXue49sW3HWQLYBf2lo1lhzX8tAG7RxO2Ka3679fXPutNZAnprNNaMJyaP360YVeo5rqmYBPDSWasiBodgPCZoq1ysTnlI8XbQxyb2qLFQlq6ktn-1rTwDPu9EDLghEH4vRQaEFKbzJNghw8ebp1j61Pi1dtcV6miBdxn0E5hlTjomQg6cgIlcUrc23Zt-0Gl9y_cT3ybvnI8n4UV5qMu_iMDd7LATKRKddtExseZmdyGB0k85aYT4oWKG6G8lhBVGZsqR7PjvH8AxmRhc4FL6EtBp9iqMuOLo6gnEQXjbf6BaofxoNO638kNM4q2IHYv6asJcgKGo9IEVI4mv5ncIDG9HwUOO8bnaFAAaLGDWVhvh0MJBPs-mP982WYsGkrWk-3PjXS63fm41d2R5uxpyhSUmu3iGIe0QJ4KcNZ2mEx5hy1DiuykDOv6PXByjH4vOqn-9EevQ%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: e454d5ada0ee387ca2095aa0f3aa9471dadf0cc2f7518f78c640b63d981502af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:03 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4194
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 2744 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2804a62f734cf592c4a5def92b3de38ea8a2acfb1fbb6aa95c736682cc87c6d2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 080D 118 KB
40 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 04:40:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51459
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 04:40:24 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame C2D3 38 KB
13 KB 8ms
8ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11684
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 15:43:19 GMT
expires: Sat, 02 Nov 2024 15:43:19 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame A2D8 38 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:48:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14994
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Nov 2024 14:48:09 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 08F9 118 KB
40 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 04:40:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51459
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 04:40:24 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 281C 38 KB
13 KB 9ms
6ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11684
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 15:43:19 GMT
expires: Sat, 02 Nov 2024 15:43:19 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal90004.redintelligence.net/ Frame D072
Redirect Chain

https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6dba62b22e&subid=&uid=699d568a6d2778e8&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6dba62b22e&subid=&uid=699d568a6d2778e8&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

114ms
93ms

Script
application/x-javascript

138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6dba62b22e&subid=&uid=699d568a6d2778e8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAL-Lu0JFZaODD9KumtUPv-QppuW9oGmFlZynyQ_wLhABIIjO5BFgleKQgqAHyAEJqQKP2hbrhNyxPqgDAcgDmwSqBKECT9BWG07Q6ZIOKZeLkIiavhd157-G-kk_xy71xp3vfG3zyXpUAUeC0fQjTdFvSa6KXHAor54vevfofuX6C0bXcFYLb9OFyJ345ej2t5JKxRafDxYXKXRhj6tXj13XUvJKXFs2xC9ajDJsb97RYyQ73Uqe-6N-YWMiRfL7qI-VvVdSBi5e7PNAaYHESLObJEECi3vcFw9SmYkVvtBx8lyJdYKEvYp9ktLe_6BhLghKliuMT70B_lO4MBdo95C69IKp7uKtABnLOKvf1RqiIDUEYqeNQMpahQhuUXaIeOQ3QbkscTXcUP1v4g_uLvO-zTA38rAGAim3ysf1XqmIlouZ35AxY2Mnih6afZX_CKVoa0dCXOsqbUSjcfWShDIzHICyrsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNaD4rVKmG_yFKPiMOj8xnzaNmsNdlhquqkxrhHP7mbOw5vRcXvU3foJ9DxKr8-lgmd7droN5mGAE%26sig%3DAOD64_2LI_VVFVXM9iKmmMFK_C0zEQw9yQ%26client%3Dca-pub-7031645305449270%26dbm_c%3DAKAmf-A9l9y5h-Ug6uUPjy_F1rio32W5AO3FJmJuvkkLIewWF8oVtbT4ctdWlN9nwtAj_H0JS0I9vszvEouVlZfaZVGYoM1B08mzI6XTBQQT8OdIwhJbMU9zQhfM_IpAKJTrdPf25rqRhsB67ECT00r2Y9735b5lj_5Yzr7TgN5Y4X6wcYZdxkU%26cry%3D1%26dbm_d%3DAKAmf-AgoeOCClwj_P2E61ATD31bqvSw2FfQT37SxfEu7E2Bq-QkqrB_DL6ag2MwM57u6un1euK4c9HOeXXoFTQCeKeOu2g3Euo6eCtdueXB4DXue49sW3HWQLYBf2lo1lhzX8tAG7RxO2Ka3679fXPutNZAnprNNaMJyaP360YVeo5rqmYBPDSWasiBodgPCZoq1ysTnlI8XbQxyb2qLFQlq6ktn-1rTwDPu9EDLghEH4vRQaEFKbzJNghw8ebp1j61Pi1dtcV6miBdxn0E5hlTjomQg6cgIlcUrc23Zt-0Gl9y_cT3ybvnI8n4UV5qMu_iMDd7LATKRKddtExseZmdyGB0k85aYT4oWKG6G8lhBVGZsqR7PjvH8AxmRhc4FL6EtBp9iqMuOLo6gnEQXjbf6BaofxoNO638kNM4q2IHYv6asJcgKGo9IEVI4mv5ncIDG9HwUOO8bnaFAAaLGDWVhvh0MJBPs-mP982WYsGkrWk-3PjXS63fm41d2R5uxpyhSUmu3iGIe0QJ4KcNZ2mEx5hy1DiuykDOv6PXByjH4vOqn-9EevQ%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-7031645305449270%26output%3Dhtml%26h%3D90%26slotname%3D6838607656%26adk%3D1683087958%26adf%3D3570656667%26pi%3Dt.ma~as.6838607656%26w%3D779%26lmt%3D1699037883%26rafmt%3D12%26format%3D779x90%26url%3Dhttps%253A%252F%252Fwww.balatarin.com%252F%26hl%3Den%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1699037882791%26bpp%3D1%26bdt%3D358%26idt%3D268%26shv%3Dr20231101%26mjsv%3Dm202310310101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D1df45741068a73f8%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w%26gpic%3DUID%253D00000cb3a430dbd4%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D225557828045%26frm%3D20%26pv%3D1%26ga_vid%3D898914513.1699037883%26ga_sid%3D1699037883%26ga_hid%3D1670824771%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D605%26ady%3D1302%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079080%252C31079231%252C31079347%252C44785295%252C44795921%252C44807047%252C44807336%252C44807454%252C31078297%26oid%3D2%26pvsid%3D3561240333002577%26tmod%3D425826272%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Do%257Co%257CEebr%257C%26abl%3DNS%26pfx%3D0%26fu%3D256%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3DsJPmhRYXbv%26p%3Dhttps%253A%2F%2Fwww.balatarin.com%26dtd%3D272&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.balatarin.com&random=4440897818852&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272
Protocol: HTTP/1.1
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5d216925e31ef785633d07b92985e143557cdb5ae453244ba3abe431018eb9c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 03 Nov 2023 18:58:03 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 31604400131990004444550012497004
Connection: close
Content-Length: 1199
Expires: Fri, 03 Nov 2023 18:58:03 +0100

Redirect headers

Pragma: no-cache
Date: Fri, 03 Nov 2023 18:58:03 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6dba62b22e&subid=&uid=699d568a6d2778e8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAL-Lu0JFZaODD9KumtUPv-QppuW9oGmFlZynyQ_wLhABIIjO5BFgleKQgqAHyAEJqQKP2hbrhNyxPqgDAcgDmwSqBKECT9BWG07Q6ZIOKZeLkIiavhd157-G-kk_xy71xp3vfG3zyXpUAUeC0fQjTdFvSa6KXHAor54vevfofuX6C0bXcFYLb9OFyJ345ej2t5JKxRafDxYXKXRhj6tXj13XUvJKXFs2xC9ajDJsb97RYyQ73Uqe-6N-YWMiRfL7qI-VvVdSBi5e7PNAaYHESLObJEECi3vcFw9SmYkVvtBx8lyJdYKEvYp9ktLe_6BhLghKliuMT70B_lO4MBdo95C69IKp7uKtABnLOKvf1RqiIDUEYqeNQMpahQhuUXaIeOQ3QbkscTXcUP1v4g_uLvO-zTA38rAGAim3ysf1XqmIlouZ35AxY2Mnih6afZX_CKVoa0dCXOsqbUSjcfWShDIzHICyrsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNaD4rVKmG_yFKPiMOj8xnzaNmsNdlhquqkxrhHP7mbOw5vRcXvU3foJ9DxKr8-lgmd7droN5mGAE%26sig%3DAOD64_2LI_VVFVXM9iKmmMFK_C0zEQw9yQ%26client%3Dca-pub-7031645305449270%26dbm_c%3DAKAmf-A9l9y5h-Ug6uUPjy_F1rio32W5AO3FJmJuvkkLIewWF8oVtbT4ctdWlN9nwtAj_H0JS0I9vszvEouVlZfaZVGYoM1B08mzI6XTBQQT8OdIwhJbMU9zQhfM_IpAKJTrdPf25rqRhsB67ECT00r2Y9735b5lj_5Yzr7TgN5Y4X6wcYZdxkU%26cry%3D1%26dbm_d%3DAKAmf-AgoeOCClwj_P2E61ATD31bqvSw2FfQT37SxfEu7E2Bq-QkqrB_DL6ag2MwM57u6un1euK4c9HOeXXoFTQCeKeOu2g3Euo6eCtdueXB4DXue49sW3HWQLYBf2lo1lhzX8tAG7RxO2Ka3679fXPutNZAnprNNaMJyaP360YVeo5rqmYBPDSWasiBodgPCZoq1ysTnlI8XbQxyb2qLFQlq6ktn-1rTwDPu9EDLghEH4vRQaEFKbzJNghw8ebp1j61Pi1dtcV6miBdxn0E5hlTjomQg6cgIlcUrc23Zt-0Gl9y_cT3ybvnI8n4UV5qMu_iMDd7LATKRKddtExseZmdyGB0k85aYT4oWKG6G8lhBVGZsqR7PjvH8AxmRhc4FL6EtBp9iqMuOLo6gnEQXjbf6BaofxoNO638kNM4q2IHYv6asJcgKGo9IEVI4mv5ncIDG9HwUOO8bnaFAAaLGDWVhvh0MJBPs-mP982WYsGkrWk-3PjXS63fm41d2R5uxpyhSUmu3iGIe0QJ4KcNZ2mEx5hy1DiuykDOv6PXByjH4vOqn-9EevQ%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-7031645305449270%26output%3Dhtml%26h%3D90%26slotname%3D6838607656%26adk%3D1683087958%26adf%3D3570656667%26pi%3Dt.ma~as.6838607656%26w%3D779%26lmt%3D1699037883%26rafmt%3D12%26format%3D779x90%26url%3Dhttps%253A%252F%252Fwww.balatarin.com%252F%26hl%3Den%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1699037882791%26bpp%3D1%26bdt%3D358%26idt%3D268%26shv%3Dr20231101%26mjsv%3Dm202310310101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D1df45741068a73f8%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w%26gpic%3DUID%253D00000cb3a430dbd4%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D225557828045%26frm%3D20%26pv%3D1%26ga_vid%3D898914513.1699037883%26ga_sid%3D1699037883%26ga_hid%3D1670824771%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D605%26ady%3D1302%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079080%252C31079231%252C31079347%252C44785295%252C44795921%252C44807047%252C44807336%252C44807454%252C31078297%26oid%3D2%26pvsid%3D3561240333002577%26tmod%3D425826272%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Do%257Co%257CEebr%257C%26abl%3DNS%26pfx%3D0%26fu%3D256%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3DsJPmhRYXbv%26p%3Dhttps%253A%2F%2Fwww.balatarin.com%26dtd%3D272&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.balatarin.com&random=4440897818852&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Fri, 03 Nov 2023 18:58:03 +0100

GET
H3 200 GenesisSansHead-Light.woff2
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 080D 23 KB
23 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/GenesisSansHead-Light.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bba2d5622e1a33c1bd924e07f396c234a390f0bf9bb5fd1394521df422ad3607

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 10:03:29 GMT
x-content-type-options: nosniff
age: 118474
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23900
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Nov 2024 10:03:29 GMT

GET
H3 200 GenesisSansHead-Regular.woff2
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 080D 23 KB
23 KB 11ms
11ms Font
font/woff2 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/GenesisSansHead-Regular.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43cbe861b09360a856de530e3aac37acab9201d0eb166c906b26e0f71fc6ff23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 10:03:29 GMT
x-content-type-options: nosniff
age: 118474
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23636
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Nov 2024 10:03:29 GMT

GET
H3 200 GenesisSansText-Regular.woff2
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 080D 37 KB
37 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/GenesisSansText-Regular.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46b2dc3fc5e9ccbcde38dfcc96d4545befae794ae947ea3602693f2e7126b057

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 10:03:29 GMT
x-content-type-options: nosniff
age: 118474
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38296
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Nov 2024 10:03:29 GMT

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame C2D3 38 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:48:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14994
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Nov 2024 14:48:09 GMT

GET
H3 200 GenesisSansHead-Light.woff2
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 08F9 23 KB
23 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/GenesisSansHead-Light.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bba2d5622e1a33c1bd924e07f396c234a390f0bf9bb5fd1394521df422ad3607

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 10:03:29 GMT
x-content-type-options: nosniff
age: 118474
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23900
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Nov 2024 10:03:29 GMT

GET
H3 200 GenesisSansHead-Regular.woff2
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 08F9 23 KB
23 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/GenesisSansHead-Regular.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43cbe861b09360a856de530e3aac37acab9201d0eb166c906b26e0f71fc6ff23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 10:03:29 GMT
x-content-type-options: nosniff
age: 118474
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23636
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Nov 2024 10:03:29 GMT

GET
H3 200 GenesisSansText-Regular.woff2
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 08F9 37 KB
37 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/GenesisSansText-Regular.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46b2dc3fc5e9ccbcde38dfcc96d4545befae794ae947ea3602693f2e7126b057

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 10:03:29 GMT
x-content-type-options: nosniff
age: 118474
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38296
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Nov 2024 10:03:29 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 19A5 0
0 45ms
43ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvcd_i-853BqfKR6aHG5WBj7F2EVxTOEHvJe33wGeVeA8Cd91Cq9PHiIovjWdaApxM1bLy1aMVijHv0u3fKMzK-jqWSIAJSqvLL5VlvHuZiyv-lLVLojvSnw3FeDzVnCZg4MDN01KfvbC34EfMJZccvmrpFHQNPNd8bFVuY0TsUsj-BkR0iQ-w8HWTsNEwa936jq1bQjhhVyakJrCfxHIILgLe57C4CEoKSDz2gynE9DhfwQuXfkEf4ocj2QwFDsjHTdDWz7kIyh73dxuhfTapCHMuft3xvd9Tl3rW88Os8xfEpEgQ5m897cmri1d9u4U5dob1_7tMHKsHu2IjRU4MFYFymOHAEcFpbTz2XVcd1_KE8QekK0QlrqX2qMsJY5F_GZ73UtZN-zsHaUs94FDKnQHt2PuGv350ra69bsb-J4BWYlsDO5nlS8mjcR7ppk2bnFhNOCKOyfDqiH6pzI3rmlxeE_rXTBC8m-KWZgwwcV6fqC6oi3UjWMU3tChylFWe2xmFDn-Fy-mWY7tUoGeeA0WSJ4wqNMRg1oGo9_87gqUeZfCWRiIJyAT-Q1Bq_rJcvCXdZWX1uHpXgGj1uAXK-AUtNyeCRH6eQmH6-HFMbGRWZNWkS6xQYOOXDzzibDb_fxO4-edK8RIeqDURFvnYhSRuX1L2yktA1Ez0bChmK8o_qneInpBDRqDYCI3SSX-9aoOxfFE7WOQjzw_omF2OCfbPqIdXsWw4rBGkcKWci9XkQQ5rGF4kLlDf6fATxEB1Nq3lNhamay1ECIxAQdrc0UTpr_eUgEtGOzsXvcmEcO0IPJo56czPXBjYKIPDddYUb5YgcOzVFdhEWxAo1Pd2GQ8OzVaqKIjO0zL5ZUD1D6QpbfTWXbDFWHGckVTkvgfGEE1WZsS-T68wIc3iQY5I4iQhSTM8Adn2WbPMjgwz2hig3aOUu-o8nk8pll3AyM03fbwKvbnW8L7g6XLjCuqqdzyfrfN2eIWt6HO1NFU53CdbUZwLXgXriQYAssHkdmHVgU4DF8wQ0aWsMeaIFuniGURJWFp458ywRekQ6qqEXNK4QE434Vbk1aqhfbrI0a66OuboYgQc78iym9ycoRNnPdswUTOs0x5l64T-ChLbiN2Qi1xItt83Wr9frYiIzuTVxWO8KTsiLDhtc22UhbEU0QRlHICibKJo82gUea1sGhzSP_ERS8P3olllu2AVyDZBiIhptsbYi359uyHFeX6GK7XCLvQGsODDvXAaLjcrBjnsf61Cp7N_me43ffauNkHROCz-YU-7ixJUKZRXnCjEyqSHb3uOg1HM5trTF7-1fBYmjai6K6Q4mIaI2o3PONYLO2dYnU7huHK2Y8VFOuG6Mqc0z_ATslJXgwdbceolaWoFpHC5oEmMm5Jfk0uJPHg&sai=AMfl-YSKGCR1qXX48aBsIaMxK1Zvh556uwEZcXx1vnHG2RwDuPCJ6z_E6BM8YRBVpqRMe4I5suzb-8nMqe3d52dFgbU-sEHG61E3Wyd-il_HvDyBbCObshwKqug2TrFX_8Ar-x1X9-Bz4aWrsE2DQlHkNy9O92X8bAHSK6UiLvR9JQmEPdINu5gf_A994fWE3Vvc2k8T_cSAz4ZYQ2rtWHhIeXfR7zWM9ZGFDaKHjABuofHo1MarySAVHjcr0a1H7uVMk_tYJxQhJTLSIZyIlOaoXgaeKJ_wLd68JK25E2rOpQqQYudvUqU7h-NKcDz8BwnqPp3GSh8Rn5E5ZyWR5rUT5KNLz4kyptqHOFDEL_VAt7g1kkzbJIW6jsmk5tAitmP3MMEDZwkHQlokjBzjtWcGwwrd&sig=Cg0ArKJSzAAH89Jmh22_EAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=386&vt=11&dtpt=192&dett=3&cstd=187&cisv=r20231101.85281&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 080D 8 KB
6 KB 77ms
49ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b53d225259d5287c25e8716fc0e9216046ab6ffab29c5e78922a41f515f1514

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5825
x-xss-protection: 0

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame 281C 38 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:48:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14994
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Nov 2024 14:48:09 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2744 0
0 46ms
45ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsthUV4iyRTrcHwD_b8JsY6JW3ACrd8o18RxqfB-h5Qq7s1marE24B4cxUIze1I6F0pj0sLN9YXB8jtHrOD6JjUJLibMVflrAo2aRocnRJqkLsWnQJ3qSJbcDUmrQZncNtF0xHpXmT52mxUt0r0tT5Apb-UQI9E2dbf5TOgdlXzLYlbBOxkLpS8tbdgXZbv1cQUVS0nI6Ak8YXCmlIl30Ab9Mk5tngzSBNXP5SNX3cCBWtul1Utj1fe0EWrCmWYF9UDzHlIzME_r8XNnTg4YUay2vzTO1G7ku2tUHl4ijbhR5UVaxwjZqcNbZA_dNBhTE2E5XFHvpyYXYbhuEJvmXwKbqm4N8syh72Hc9wecHPL60AclhMXZQ93au5_obIONY2xvNSdJOfzZnb1bJbOddv-UmEoiKWcFvMXAnvHlZW3ph0Pzm65qxydLR1P4BTIdALcJTwpHFq4AJ538W6s1aFRxIM9pxLvUXh_Lt8lw6Mn_7ckqvF5fa4h419HHp__MII9gcbnV-LfsrjVVkME0GuNznG0bCqsYij6QReUf7lhO_7c8q4Uanm6fJv4iYPJPhwlH-IU7mZmWbIQoBXIws1d8ZwlKCP7vvxgrqqEX_oK3SW7PSN1O6zAYNw1Gh2PIxI5UZqwBYKG5Sz-SVocTocGPn__zFYSaFkax9c0T7Fd2N6dvHo0Z3nFugPIOobtqmxbAP_o9GDAtfAcPXZSwIFmeqMoGfvsXNk3Wv2C9C5Xlpg20zW9Xx45ivDCnFut9Q1smQjb2t1QWo65BpRDLGjq73yvUxsnQ0AwU8cRAUZh7shDhQ6_5ECONag9bHdqHocJk8BPduAfldFJRqcQNxumbWQDGOoZJEHadRUl4GwLJ__Cn16QsXbgigI4yx4vIVaSG6Jlk2Bb6ct5qHHvMfKHvbspK2acoGjXo2NCokN10LkxxBevAtRuHW9AmL92D9ib3NHvy6ZymBoabQBrGJd6nDIQCBCrHG4Hb9kWd7sycv6kvR2M8MkJrDrQ3gZW6nJku2pQ-mxCA7brhECfPfnrnixwtAcN5eDUH9-SBFkUqEC0U1Ciybo7caeJ9hotHj7yLNyPj7TAYSALBULGP0GDe_i_KZAQn4VUH3YsGDe9B6GlGFDSVUglEvmQ9qULeF6lH2mliJN4HuXoVvT1F-JxovZCmDfPou4m4KkIxJzYm4f3qizJ0V4dhLS92Qn-Nt4x2Cwvk2CH3w-VbfVLOoolyax7aasBDrVtefYMlXyQSfRtQVVcpj3i79CbU8QJiLx0cXUQZdRmC4xWqpExA_QS80PNFmULpLVfYT-VnwsFo2ZSFMoMViV5w4mLZbuskwV23U51lomUgUlyVfeaMXZNONPJIsqniI71RplI&sai=AMfl-YQ9RAGU0caIPIdcMLgEhVIAsf1aGKIqcL12_hQE_D2baP2hyN5Fh8Den9C8uNQDSrlAGJNEVItK1dtClggc13CdNWQysCEJ2Tor6vtbQtJUS2zELyz9y35l6Q4IEYCuKpXhl2PHQHhiR2ebdkkJBm3M6fEqMUIBbxoYezoessPYqO2v-l_J9i8IVJEEI0qqXlA8w8XE7sCJmKB6batWBMNi5D_cHt3lJaKO8XTGJkxPONHeYCu-VGLDotYjr0KsvRLTQXxJAb1cJXGaXpdak-pDJ7kezlhentlj8kQan_ph9SeCISfc6iAKIVKSvLi6N4LUki6IgiYS8GGTSSLF8MzgXF2hwJ7RuczvhQBgqIdUwKUGPIHV1aGid0DP3LvMoELeu2KotZ62hQmo_TdhtHVy&sig=Cg0ArKJSzEEbB11207yWEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=315&vt=11&dtpt=174&dett=3&cstd=134&cisv=r20231101.16554&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 08F9 7 KB
6 KB 62ms
49ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7bc6dccb63d003252141ea84540a8a0ebabf143b1828063cec2a34bea8ca8150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5789
x-xss-protection: 0

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 080D 8 KB
8 KB 8ms
8ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/logo.png

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2a78ec0800976a7fbcd2f14881e6be9588f6f95d7e2ebcae41236f6ecfe3206

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 05:15:56 GMT
x-content-type-options: nosniff
age: 49327
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8111
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Nov 2024 05:15:56 GMT

GET
H3 200 60015186_20230202011649420_award_logo_300x250_default.png
s0.2mdn.net/ads/richmedia/studio/60015186/ Frame 080D 2 KB
2 KB 10ms
10ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60015186/60015186_20230202011649420_award_logo_300x250_default.png

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5aedc8850b65270522a00e0f6a65196ec804be7ae19531af2b137cd0df7ac30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 10:03:36 GMT
x-content-type-options: nosniff
age: 32067
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 09:16:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 10:03:36 GMT

GET
DATA 200
OK truncated
/ Frame 080D 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 60015186_20230213011001899_DEFAULT_300x250.jpg
s0.2mdn.net/ads/richmedia/studio/60015186/ Frame 080D 114 KB
114 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60015186/60015186_20230213011001899_DEFAULT_300x250.jpg

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca899679eac9e707d4cfdf4a200b35ff18ce29cc0ff7462f4082d6d06dc30cef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=zUeomBuNZj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 10:31:49 GMT
x-content-type-options: nosniff
age: 30374
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 117098
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 09:10:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 10:31:49 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/1484961235833605488/ Frame 08F9 8 KB
8 KB 7ms
7ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1484961235833605488/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2a78ec0800976a7fbcd2f14881e6be9588f6f95d7e2ebcae41236f6ecfe3206

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 05:15:56 GMT
x-content-type-options: nosniff
age: 49327
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8111
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 13:03:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 02 Nov 2024 05:15:56 GMT

GET
H3 200 60015186_20230202011649420_award_logo_300x250_default.png
s0.2mdn.net/ads/richmedia/studio/60015186/ Frame 08F9 2 KB
2 KB 8ms
7ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60015186/60015186_20230202011649420_award_logo_300x250_default.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5aedc8850b65270522a00e0f6a65196ec804be7ae19531af2b137cd0df7ac30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 10:03:36 GMT
x-content-type-options: nosniff
age: 32067
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1630
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 09:16:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 10:03:36 GMT

GET
DATA 200
OK truncated
/ Frame 08F9 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 60015186_20230213011001899_DEFAULT_300x250.jpg
s0.2mdn.net/ads/richmedia/studio/60015186/ Frame 08F9 114 KB
114 KB 9ms
9ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60015186/60015186_20230213011001899_DEFAULT_300x250.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca899679eac9e707d4cfdf4a200b35ff18ce29cc0ff7462f4082d6d06dc30cef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1484961235833605488/index.html?e=69&leftOffset=0&topOffset=0&c=j21X6db3QH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 10:31:49 GMT
x-content-type-options: nosniff
age: 30374
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 117098
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 09:10:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Nov 2023 10:31:49 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 08F9 17 KB
6 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 03 Nov 2023 18:58:04 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 080D 17 KB
6 KB 129ms
129ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 03 Nov 2023 18:58:04 GMT

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame B0DB
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=31604400131990004444550012497004&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=31604400131990004444550012497004&actionid=879111&produktid=ratenkredit&dt_url=

0
179 B

64ms
34ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=31604400131990004444550012497004&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6dba62b22e&subid=&uid=699d568a6d2778e8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAL-Lu0JFZaODD9KumtUPv-QppuW9oGmFlZynyQ_wLhABIIjO5BFgleKQgqAHyAEJqQKP2hbrhNyxPqgDAcgDmwSqBKECT9BWG07Q6ZIOKZeLkIiavhd157-G-kk_xy71xp3vfG3zyXpUAUeC0fQjTdFvSa6KXHAor54vevfofuX6C0bXcFYLb9OFyJ345ej2t5JKxRafDxYXKXRhj6tXj13XUvJKXFs2xC9ajDJsb97RYyQ73Uqe-6N-YWMiRfL7qI-VvVdSBi5e7PNAaYHESLObJEECi3vcFw9SmYkVvtBx8lyJdYKEvYp9ktLe_6BhLghKliuMT70B_lO4MBdo95C69IKp7uKtABnLOKvf1RqiIDUEYqeNQMpahQhuUXaIeOQ3QbkscTXcUP1v4g_uLvO-zTA38rAGAim3ysf1XqmIlouZ35AxY2Mnih6afZX_CKVoa0dCXOsqbUSjcfWShDIzHICyrsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNaD4rVKmG_yFKPiMOj8xnzaNmsNdlhquqkxrhHP7mbOw5vRcXvU3foJ9DxKr8-lgmd7droN5mGAE%26sig%3DAOD64_2LI_VVFVXM9iKmmMFK_C0zEQw9yQ%26client%3Dca-pub-7031645305449270%26dbm_c%3DAKAmf-A9l9y5h-Ug6uUPjy_F1rio32W5AO3FJmJuvkkLIewWF8oVtbT4ctdWlN9nwtAj_H0JS0I9vszvEouVlZfaZVGYoM1B08mzI6XTBQQT8OdIwhJbMU9zQhfM_IpAKJTrdPf25rqRhsB67ECT00r2Y9735b5lj_5Yzr7TgN5Y4X6wcYZdxkU%26cry%3D1%26dbm_d%3DAKAmf-AgoeOCClwj_P2E61ATD31bqvSw2FfQT37SxfEu7E2Bq-QkqrB_DL6ag2MwM57u6un1euK4c9HOeXXoFTQCeKeOu2g3Euo6eCtdueXB4DXue49sW3HWQLYBf2lo1lhzX8tAG7RxO2Ka3679fXPutNZAnprNNaMJyaP360YVeo5rqmYBPDSWasiBodgPCZoq1ysTnlI8XbQxyb2qLFQlq6ktn-1rTwDPu9EDLghEH4vRQaEFKbzJNghw8ebp1j61Pi1dtcV6miBdxn0E5hlTjomQg6cgIlcUrc23Zt-0Gl9y_cT3ybvnI8n4UV5qMu_iMDd7LATKRKddtExseZmdyGB0k85aYT4oWKG6G8lhBVGZsqR7PjvH8AxmRhc4FL6EtBp9iqMuOLo6gnEQXjbf6BaofxoNO638kNM4q2IHYv6asJcgKGo9IEVI4mv5ncIDG9HwUOO8bnaFAAaLGDWVhvh0MJBPs-mP982WYsGkrWk-3PjXS63fm41d2R5uxpyhSUmu3iGIe0QJ4KcNZ2mEx5hy1DiuykDOv6PXByjH4vOqn-9EevQ%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-7031645305449270%26output%3Dhtml%26h%3D90%26slotname%3D6838607656%26adk%3D1683087958%26adf%3D3570656667%26pi%3Dt.ma~as.6838607656%26w%3D779%26lmt%3D1699037883%26rafmt%3D12%26format%3D779x90%26url%3Dhttps%253A%252F%252Fwww.balatarin.com%252F%26hl%3Den%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1699037882791%26bpp%3D1%26bdt%3D358%26idt%3D268%26shv%3Dr20231101%26mjsv%3Dm202310310101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D1df45741068a73f8%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w%26gpic%3DUID%253D00000cb3a430dbd4%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D225557828045%26frm%3D20%26pv%3D1%26ga_vid%3D898914513.1699037883%26ga_sid%3D1699037883%26ga_hid%3D1670824771%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D605%26ady%3D1302%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079080%252C31079231%252C31079347%252C44785295%252C44795921%252C44807047%252C44807336%252C44807454%252C31078297%26oid%3D2%26pvsid%3D3561240333002577%26tmod%3D425826272%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Do%257Co%257CEebr%257C%26abl%3DNS%26pfx%3D0%26fu%3D256%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3DsJPmhRYXbv%26p%3Dhttps%253A%2F%2Fwww.balatarin.com%26dtd%3D272&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.balatarin.com&random=4440897818852&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 03 Nov 2023 18:58:03 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 03 Nov 2023 07:58:04 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Fri, 03 Nov 2023 18:58:04 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=31604400131990004444550012497004&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: 8AC72685:EDD6_91EFC182:01BB_654542BC_C64456:1A429

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame FAD1
Redirect Chain

https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=31604400131990004444550012497004&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654542bce7e41c365b30feb2&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

0
179 B

70ms
34ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654542bce7e41c365b30feb2&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 03 Nov 2023 18:58:03 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Fri, 03 Nov 2023 07:58:04 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"25200521800103636","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Fri, 03 Nov 2023 18:58:04 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=654542bce7e41c365b30feb2&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: 8AC72685:EDD8_91EFC182:01BB_654542BC_C66C40:1A42B

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame D072
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=31604400131990004444550012497004&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=31604400131990004444550012497004&actionid=879111&produktid=ratenkredit&dt_url=

0
606 B

55ms
33ms

Script
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=31604400131990004444550012497004&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Protocol

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:03 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 03 Nov 2023 07:58:04 GMT
server: Microsoft-IIS/10.0
access-control-allow-methods: GET,POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Fri, 03 Nov 2023 18:58:04 GMT
strict-transport-security: max-age=15768000
x-iplb-instance: 40028
content-length: 0
proxy-host: pv.medialead.de
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: 8AC72685:EDDC_91EFC182:01BB_654542BC_C65D75:1A428
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=31604400131990004444550012497004&actionid=879111&produktid=ratenkredit&dt_url=
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame D072 43 B
665 B 118ms
84ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=31604400131990004444550012497004&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:04 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: 8AC72685:EDDA_91EFC182:01BB_654542BC_C64458:1A429
x-iplb-instance: 40028
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

GET
H2 200 impression.php
t23.intelliad.de/ Frame D072 43 B
559 B 63ms
14ms Image
image/gif 35.157.49.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t23.intelliad.de/impression.php?cl=2353636373136323131303&cp=101&ag=248&bm=100&bmcl=5373735313236323131303&crid=101&timestamp=1699037884&co=
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6dba62b22e&subid=&uid=699d568a6d2778e8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAL-Lu0JFZaODD9KumtUPv-QppuW9oGmFlZynyQ_wLhABIIjO5BFgleKQgqAHyAEJqQKP2hbrhNyxPqgDAcgDmwSqBKECT9BWG07Q6ZIOKZeLkIiavhd157-G-kk_xy71xp3vfG3zyXpUAUeC0fQjTdFvSa6KXHAor54vevfofuX6C0bXcFYLb9OFyJ345ej2t5JKxRafDxYXKXRhj6tXj13XUvJKXFs2xC9ajDJsb97RYyQ73Uqe-6N-YWMiRfL7qI-VvVdSBi5e7PNAaYHESLObJEECi3vcFw9SmYkVvtBx8lyJdYKEvYp9ktLe_6BhLghKliuMT70B_lO4MBdo95C69IKp7uKtABnLOKvf1RqiIDUEYqeNQMpahQhuUXaIeOQ3QbkscTXcUP1v4g_uLvO-zTA38rAGAim3ysf1XqmIlouZ35AxY2Mnih6afZX_CKVoa0dCXOsqbUSjcfWShDIzHICyrsAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSOwDICaaNaD4rVKmG_yFKPiMOj8xnzaNmsNdlhquqkxrhHP7mbOw5vRcXvU3foJ9DxKr8-lgmd7droN5mGAE%26sig%3DAOD64_2LI_VVFVXM9iKmmMFK_C0zEQw9yQ%26client%3Dca-pub-7031645305449270%26dbm_c%3DAKAmf-A9l9y5h-Ug6uUPjy_F1rio32W5AO3FJmJuvkkLIewWF8oVtbT4ctdWlN9nwtAj_H0JS0I9vszvEouVlZfaZVGYoM1B08mzI6XTBQQT8OdIwhJbMU9zQhfM_IpAKJTrdPf25rqRhsB67ECT00r2Y9735b5lj_5Yzr7TgN5Y4X6wcYZdxkU%26cry%3D1%26dbm_d%3DAKAmf-AgoeOCClwj_P2E61ATD31bqvSw2FfQT37SxfEu7E2Bq-QkqrB_DL6ag2MwM57u6un1euK4c9HOeXXoFTQCeKeOu2g3Euo6eCtdueXB4DXue49sW3HWQLYBf2lo1lhzX8tAG7RxO2Ka3679fXPutNZAnprNNaMJyaP360YVeo5rqmYBPDSWasiBodgPCZoq1ysTnlI8XbQxyb2qLFQlq6ktn-1rTwDPu9EDLghEH4vRQaEFKbzJNghw8ebp1j61Pi1dtcV6miBdxn0E5hlTjomQg6cgIlcUrc23Zt-0Gl9y_cT3ybvnI8n4UV5qMu_iMDd7LATKRKddtExseZmdyGB0k85aYT4oWKG6G8lhBVGZsqR7PjvH8AxmRhc4FL6EtBp9iqMuOLo6gnEQXjbf6BaofxoNO638kNM4q2IHYv6asJcgKGo9IEVI4mv5ncIDG9HwUOO8bnaFAAaLGDWVhvh0MJBPs-mP982WYsGkrWk-3PjXS63fm41d2R5uxpyhSUmu3iGIe0QJ4KcNZ2mEx5hy1DiuykDOv6PXByjH4vOqn-9EevQ%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-7031645305449270%26output%3Dhtml%26h%3D90%26slotname%3D6838607656%26adk%3D1683087958%26adf%3D3570656667%26pi%3Dt.ma~as.6838607656%26w%3D779%26lmt%3D1699037883%26rafmt%3D12%26format%3D779x90%26url%3Dhttps%253A%252F%252Fwww.balatarin.com%252F%26hl%3Den%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1699037882791%26bpp%3D1%26bdt%3D358%26idt%3D268%26shv%3Dr20231101%26mjsv%3Dm202310310101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D1df45741068a73f8%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w%26gpic%3DUID%253D00000cb3a430dbd4%253AT%253D1699037882%253ART%253D1699037882%253AS%253DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D225557828045%26frm%3D20%26pv%3D1%26ga_vid%3D898914513.1699037883%26ga_sid%3D1699037883%26ga_hid%3D1670824771%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D605%26ady%3D1302%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079080%252C31079231%252C31079347%252C44785295%252C44795921%252C44807047%252C44807336%252C44807454%252C31078297%26oid%3D2%26pvsid%3D3561240333002577%26tmod%3D425826272%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Do%257Co%257CEebr%257C%26abl%3DNS%26pfx%3D0%26fu%3D256%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3DsJPmhRYXbv%26p%3Dhttps%253A%2F%2Fwww.balatarin.com%26dtd%3D272&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.balatarin.com&random=4440897818852&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.49.61 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-49-61.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
server: Apache
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW NID PSAo PSDo OUR STP OTC"
content-type: image/gif
cache-control: no-store, no-cache, max-age=0, must-revalidate
content-length: 43
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A2D8 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Ba-s2u0JFZcboDprnBeKik8gIAAAAADgB4AQC&bg=!f3ylfDPNAAb4oU7C2KE7ADQBe5WfONFonqz5uDuBspYRAq7IhYP68RIFfXpifK2gbuaJvF0-7lHD4P68YE-BdhoWIx4OAgAAANBSAAAAB2gBBwoASoYzOmikJ_G3QZr3nfvUR-oI-cnnvNFv2Duc-M-2PUPxXDmoxjnW2tyapQ45b9PiO08iKGT7Xnmt92jJYRrk9BaeJkWRA2hm-RQtmQNBsISGcBW2_QgKpPM8mshMX9vupi-YdtOuJk_pnJ88opYKhshHmWvFb_jsjfqWUa-gfwisE8bYVIXnRxwqr4l05WGCoihX5HOcmEWBJ05jGcldA8eTPoh2_-mfv9Y6-NWFjxhw0pt-2bEwpe0BnqsJZrGwn03mQoMHhNXUAYziPIPi2UIL3-z0hYeYZKSXgV0cXpR7o47Pp5qBfxSIpe-amAeFkwvU4jjAN6KRcowM5Mtchu6LwBqROLhHPa5ZOT5LfQGhcdSXdwdhAnSmhksUZDMxvgyIlO5YPQhpnWpJQFI6VUvgOhuRyTH1vbqYjxq5Vd-ygAeACEXDizyUUcLNHB_9UT5upZVVTX1_V-ExmRI8grVbiJ8bSYCLkpxr7mbdDqtrQfpgk1jSpyH6oWvwGUX-eceXJVaUkUfpm6fWlsB2UgY8oUoaG-RSwIB1_x0Ob2mkZCVbsGJBBzNgbWbRiD-okDZqFqzf4PgZu_D1iER38f4au7783JqcGG3b-mxKRD1ow4ou3wiF4fY2SqOOm9m3evWouYp1t0YP8kdRXtCHboK74GMmtpRiW3GYLBKiKijAuwSx55A9z-0ZlMIKI7DjLeonfhZSEsgaRBlujHcn_rPgWqJ6qNDhtR3GJZv0r04i-3VLPX_sKZtYB5-xkg0wIONwYgXrO6omeRVxz23QOoV4WH8gAR88k67zYFZRRixFIS7rz3i-_KPXU5iX7GySvcL_4P7XK0SbUJWXr73LgxJ1FlsgZ8SOxuc64851eUtUHqu-i2p5Cntk2W9UU9cHRhkATKl8yPayD9uOtdtgVQ_Nal1FpOwGiDSw2QQQSoMwGWjE88p6_n7Bu-U0UN8GYViCmnlq4oyW4fExAAtuF89z_H9UrxBXtrAQ4mUEAXX0iM-l18t1oIc9ro3sup1OouyYojpCpBbNkf0ETPgbf1K58rV3Eq2QXS0hlKronNRIjU_e89g4j-Qofi3F_C4cTp7dTRzAQXTwKsM4_HLP62ly-yacaC3m69vWZMZrk0Q_ie7_frxfKKHwfaRBoc34i4Gni8ftwl1xAai-jXSUihMwSnlPNiwTo-TZS-EVrflCEkOc4V48IPB9brgwGKU

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame BF06 38 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:48:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14995
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Nov 2024 14:48:09 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C2D3 0
20 B 46ms
46ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B-SJlu0JFZYvaD4bzBLuUtYACAAAAADgB4AQC&bg=!sLOls_zNAAb4oU7C2KE7ADQBe5WfOOmuL9D681HAeybDh6k9Z3z4LZLb4e1HbEWLnTklABNzRDM89TgbAZM84pJmravQAgAAAKVSAAAABmgBB5kDMLpK1wqxa4eMnW6crA2c5EB-StACE65e1_zSnjc8yrbW1G6g_nXZzXCpVRA0f6qQlThbIKYDqcSrh7IoWFN6nKsSevizjmFyJ2aRcB2FQUC8Gulqj7vlxswDS9R7Tbr_zcNWSqhIar3Prcm7sCl6gm5GzMukB52CFdrlrV3PX38VjEQJMAD9pf9OpbvYuZh6dM_u1eAo06k3iOXmQxX2ye4NUMtM8Q9MAUZ_JI65BDjyn2lQomyu7gYqiD8om4Rht_1-eKJNTYbYM4tqcGbMc85B6BJkEHj6PWXsvFnmCbV3z5TQywtraQTZ_nTB_rR0aDeGKlSyTeBnHxvm3ylwuKY_bm2ldPKK0ngmQiUL45gW2gHPCjV2xbjZNeJY677pTqU8sCGWHCPlr8iOBQSbgQfbuj3N1ZK4NgROhYsSPu2vCMKJZXlzKQNutdevT3LBHoOAU1SDujyO8ep7c-GvDmnDyOzrso9x4KnL_kBuQntfJlswSH9SQxCEcyC5p8ecw2YUC-EOdNdwMaG_CaIMfX9_Dx-zzqt23PUcGN1DH5hxjF3yU8Y_IzY4VWPmqC3EhHOWdGDaWZBvARxPzIX2XTFdqP-xgNnUhSPZUoijKK2uHw5wYvVAKrR3Si80qHXA9s2ZOU_fsnOabNa2ZQf4XeaKYDt9C5_Yz-54xbcoGvPGZG_jn4gHL7l0vb2JFv0UXzE5qGCkLZ3Zc2sYvJxCAogNBTGnyRySQEkl0tuw_vn0FDsRfLl18YO1-x-meo5dyPQBnEqVwEoXeuJ3K3P8F8ZdxI8BNCAGBm67xsscGz7rNHFAb3nhR-nbCqkr-ziJSveK_Gw-0e3pk_ItrKjexd3BwUYsVSx4OIizRKU6GgUmEdCJlfi98mNg7SNqEDhUEcAo7Q-h6tf0Q_acsGfKebAIqi_qzZI6y4WPVvI3FgVdo8wIEg2ql4YdwkKEz7QI5DK9ULI2kUiS6WPLMH48X7F3Tfo2dOqKXfertYJpMVt8Mk-YmzGYju-HCq_v1_8z-9i23m3Lhg5WumAiuXarxo310nmPka9Zg05ahtCq7qzzmcCuxRSD2d2bTPNwCDKd9g

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame CCE0 38 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:48:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14995
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Nov 2024 14:48:09 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 281C 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BlPsIu0JFZZvRKtCCjuwP3auo4AcAAAAAOAHgBAI&bg=!eXqlejXNAAb4oU7C2KE7ADQBe5WfOIAVQoh5uTKeMR06gu8zoRRq8tF-Wsb2VCutkqGueEaCbCeAWHW3EmDvaw8sAgnVAgAAAIxSAAAABmgBBwoAT9AwD_HQK98N1zfAM_Q_JoY8k6NdCeQ9EutKP0IGZyPgcg3PiSqiiPigJw5-4Ro16Dmva5mlBQUCE5YnWLZC2Oj8gQUeBZSNQn9D8W4o_MiZAztAd4CIfTGkcc-rm54-TZoABUfKIFv7iOT8BaPtVgpBH9LGXP2NNWVpZ-EmoCTrKWJ-ehkCEkBydFuGdBW0X15LMRuIGxM_ya7t2pFVXQtDOydkl4qs54z2dPkyP2r0fAEZ0dYqptC8o5aj1h9tf31fOZu2du8cI2Hom_6wmKbTjf6h6wTSJ8muAuNfLi8iy4D4EQEnd9jUv0tYuptx7L3PpvOINb2oVwYId3dDf7r65b2cTX3m4cVmZceIt4fiGxtnAwm17SCnWSKXdkx-hy9pIoYqbUx_ujme9npG8oRqjM1q8KxdOe30lmaIF__Q-0ibTjMfwxNg7xlBJbjc75Lhc9OTlI8F37aKQqoG0lLc5ZpBX-RZMH00PCr6eoUlaviWgra3ob0w3rotU0HCZu0bcCmUobSc8dKFfCZWNxpMvUXvAkfpuugqJFLL2KnocKxZx01BkHRpOtSevBKHUUkNqlvuQW78OehobnTwVSd3kIRxniNhIDzPWVPNEsPl1dG9sSIPv5gYCkj8cW3TumD2ewfPyGes5whDzlsHnHhlf_0KC3HYf7HjM1ojX8aDdJOCnsnELgj8b6zJd07k0-n77CBukAkp2W2ruc4MuZIZawqcRWorz4n4pim4n7IqSRRlsptWg7tpnAW0wEcVfe1pEGxG9g5-yN52lFcOMnOEMIFB-_42iwxnrvpmhsWemIt84_ipaN9ANGqsIjSVJAJy6EGIunivrEFhmmWkD2zbXz_EFJWOC05_bCRk_izhLuCVZxXc7_-5JClGgM3VTSMxsRb01lEgU2ZWy4E5eFsMHdPnzpV_B8bvdh-157bqSZ73n4VGLPXPaihwLlvq02cAtu7_LKLBC6QRf4rsCXqcnXNv_9avDIuYILc2Nn2_gfHPD5F4FT8SgQJAw0dXgHZmH7Bk5Ggh28tjCWk9VVdDNAXJREWKNXYbxcmrZQhAfF8xjMovhSKtPK2qojWivIJb54ShU3bmnTTmZOpqFLo6yc4ygicgU_EEsBGLB_DSo-jTYWtaqF79GSuzF6oojKSK-7KsFmmtzS-tnPdEWKlWv95R33sFViLmQkLTp0lwxP1Oi25pIIoeHLWPHg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

activityi;dc_pre=CNS2t6zBqIIDFZXMOwIdfJsD0Q;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658 Show response
5994599.fls.doubleclick.net/ Frame 3299
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CNS2t6zBqIIDFZXMOwIdfJsD0Q;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658?

391 B
327 B

52ms
51ms

Document
text/html

142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CNS2t6zBqIIDFZXMOwIdfJsD0Q;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

cafe /

Resource Hash

4281341b05f1697c034074009e6bdd567ef0927232a21698b1f8149a5247c301

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:04 GMT
expires: Fri, 03 Nov 2023 18:58:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:04 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNS2t6zBqIIDFZXMOwIdfJsD0Q;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90004.redintelligence.net/ Frame 2D11 7 KB
2 KB 35ms
11ms Document
text/html 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request_content.php?s=31604400131990004444550012497004&a=20ed013d
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 27673d77d9a3a48218eddaefec11b6d9e9cfe5b91090f652485bbdfe38f7702d

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2093
Content-Type: text/html; charset=utf-8
Date: Fri, 03 Nov 2023 18:58:04 GMT
Expires: Fri, 03 Nov 2023 18:58:04 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D636 1 KB
643 B 7ms
6ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 02:22:07 GMT
etag: 48472445140208031
expires: Sat, 04 Nov 2023 02:22:07 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D072 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b99f283b471969876544d503423e928da8e8ba17d09fa9cebe6e2ea74aa3511

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ Frame 2D11 2 KB
843 B 40ms
17ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=31604400131990004444550012497004&a=20ed013d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 03 Nov 2023 18:58:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 03 Nov 2023 18:13:35 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 03 Nov 2023 18:58:04 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2D11 17 KB
17 KB 34ms
12ms Image
image/png 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=31604400131990004444550012497004&a=20ed013d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: ed54e78c5e850018b5000dc2743ee2c6a9111933f827da8dda8f26414cbcd024

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16985
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2D11 13 KB
13 KB 133ms
110ms Image
image/png 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/50502/creativesup/Fyrst-1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=31604400131990004444550012497004&a=20ed013d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 58919c2c49365f16eceb81812474ac866c47055f1855135ab35f940c2730cb35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13285
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2D11 10 KB
10 KB 34ms
12ms Image
image/png 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71572/creativesup/iQ_Online-Deutschkurse_1200x627px.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=31604400131990004444550012497004&a=20ed013d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 19e0525fa11d2620399eb4bff91f8956f6ee34e1bcc360fda3e30f189b8972a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10145
Vary: Accept-Encoding
Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D636
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESED6gyHFQK6nUTy64tItfrHM&google_cver=1&google_push=AXcoOmQLICjoZOMUBlnOJlcNz2eMQY3s4yICojeGb5Pfk6FBFyxsaIuzfk...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQLICjoZOMUBlnOJlcNz2eMQY3s4yICojeGb5Pfk6FBFyxsaIuzfkD5A2_0EYcjN9vkDPLGLmxVyk-i9Aq0JnEZv5vYEsN-CQ&google_hm=bAWoi5Y1au...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQLICjoZOMUBlnOJlcNz2eMQY3s4yICojeGb5Pfk6FBFyxsaIuzfkD5A2_0EYcjN9vkDPLGLmxVyk-i9Aq0JnEZv5vYEsN-CQ&google_hm=bAWoi5Y1aunU8CXKjp4Ljw

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQLICjoZOMUBlnOJlcNz2eMQY3s4yICojeGb5Pfk6FBFyxsaIuzfkD5A2_0EYcjN9vkDPLGLmxVyk-i9Aq0JnEZv5vYEsN-CQ&google_hm=bAWoi5Y1aunU8CXKjp4Ljw
pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 i.match
a.tribalfusion.com/ Frame D636 43 B
403 B 219ms
216ms Image
image/gif 2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEErABbT47IFkkg41oFSJi84&google_cver=1&google_push=AXcoOmTnJmWW6Dsyjoqy-09MYsZgjag_O8lYBlYF5snp_jgjOncUePUhMyweriGhsVWr-fPaKupVcd1l83yHofHBUX8XHHyonpNWfQw&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTnJmWW6Dsyjoqy-09MYsZgjag_O8lYBlYF5snp_jgjOncUePUhMyweriGhsVWr-fPaKupVcd1l83yHofHBUX8XHHyonpNWfQw%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8206d8b8fe5d925f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame D636 43 B
145 B 9ms
7ms Image
image/gif 3.126.125.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESECj_6MNqJUCN-yg-Q6bGAgY&google_cver=1&google_push=AXcoOmSqv3zUVv6P2oywonH7WalRXtzY45wREqUYKCat39iufO3QR0dSzmsOPvNpM6wi3einF1-TPmv9zeahOT9q7u4I_y8gHiBaiA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7031645305449270&output=html&h=90&slotname=6838607656&adk=1683087958&adf=3570656667&pi=t.ma~as.6838607656&w=779&lmt=1699037883&rafmt=12&format=779x90&url=https%3A%2F%2Fwww.balatarin.com%2F&hl=en&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1699037882791&bpp=1&bdt=358&idt=268&shv=r20231101&mjsv=m202310310101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D1df45741068a73f8%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZiryid7O_1cAas2NPw0FS8rTdY0w&gpic=UID%3D00000cb3a430dbd4%3AT%3D1699037882%3ART%3D1699037882%3AS%3DALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw&prev_fmts=0x0&nras=1&correlator=225557828045&frm=20&pv=1&ga_vid=898914513.1699037883&ga_sid=1699037883&ga_hid=1670824771&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=605&ady=1302&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079080%2C31079231%2C31079347%2C44785295%2C44795921%2C44807047%2C44807336%2C44807454%2C31078297&oid=2&pvsid=3561240333002577&tmod=425826272&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=o%7Co%7CEebr%7C&abl=NS&pfx=0&fu=256&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sJPmhRYXbv&p=https%3A//www.balatarin.com&dtd=272
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.125.13 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-125-13.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:04 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D636
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEPre8vl7Rngmuw7dQKbh7DA&google_cver=1&google_push=AXcoOmRCPAzcLFe0UgosFZY3L-K1UqEDtfPUZSsunuvmdp287RYkiJyv1pINDu-J7lPpH4zi6fFiZ_wm8ipi-oTLzYb-oLt...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRCPAzcLFe0UgosFZY3L-K1UqEDtfPUZSsunuvmdp287RYkiJyv1pINDu-J7lPpH4zi6fFiZ_wm8ipi-oTLzYb-oLtLOmRZWVs&google_hm=eS1TTmRjTTZCRTJwRm0...

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRCPAzcLFe0UgosFZY3L-K1UqEDtfPUZSsunuvmdp287RYkiJyv1pINDu-J7lPpH4zi6fFiZ_wm8ipi-oTLzYb-oLtLOmRZWVs&google_hm=eS1TTmRjTTZCRTJwRm0zcUk4V3hUTUV1T1Y3VlRhYXpPVn5B

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 03 Nov 2023 18:58:04 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRCPAzcLFe0UgosFZY3L-K1UqEDtfPUZSsunuvmdp287RYkiJyv1pINDu-J7lPpH4zi6fFiZ_wm8ipi-oTLzYb-oLtLOmRZWVs&google_hm=eS1TTmRjTTZCRTJwRm0zcUk4V3hUTUV1T1Y3VlRhYXpPVn5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame D636 43 B
363 B 46ms
14ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQryAZTVTZHvzG8LneW6DisEDxe-7Xdl9OJAle_lo2KkXRguRxSdyAmHPP4L9_qvVAOHj55bAT-0XtRJhGsNsTPjh5kJs_uXi0&google_gid=CAESEMiNCZIMEUPPbzVIAxsX4m8&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 377929
expires: Fri, 03 Nov 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D636
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESELOgACvPZFVUmxumgup0OV8&google_cver=1&google_push=AXcoOmS2yv52M097eoxFRov-NoQUrtKTe37pT8_LMnC15LfO-wpTGCKBL7IpbvyUsnE8JblC0MYAmqzP...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODE5MTI1MTgzNDE0NzY5Mjk0Ng&google_push=AXcoOmS2yv52M097eoxFRov-NoQUrtKTe37pT8_LMnC15LfO-wpTGCKBL7IpbvyUsnE8JblC0MYAmq...

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODE5MTI1MTgzNDE0NzY5Mjk0Ng&google_push=AXcoOmS2yv52M097eoxFRov-NoQUrtKTe37pT8_LMnC15LfO-wpTGCKBL7IpbvyUsnE8JblC0MYAmqzPIf4DjUlh3sgXLyE6hSxHliY

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODE5MTI1MTgzNDE0NzY5Mjk0Ng&google_push=AXcoOmS2yv52M097eoxFRov-NoQUrtKTe37pT8_LMnC15LfO-wpTGCKBL7IpbvyUsnE8JblC0MYAmqzPIf4DjUlh3sgXLyE6hSxHliY
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET googleredir
googlecm.hit.gemius.pl/ Frame D636 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D636 0
12 B 15ms
15ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J6ZbQPt-aW_0hUNEW2pNqY6kSWnK0nkQDEhx9K1jifgXZkrKJVYTnjNbmJSf4zMLFi84o5gQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal90004.redintelligence.net/ Frame 2D11 0
150 B 33ms
12ms Script
text/html 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/viewability?s=31604400131990004444550012497004&a=c47d9d19&vb=m
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=31604400131990004444550012497004&a=20ed013d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/request_content.php?s=31604400131990004444550012497004&a=20ed013d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Fri, 03 Nov 2023 18:58:04 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 dc_pre=CNS2t6zBqIIDFZXMOwIdfJsD0Q;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658
adservice.google.com/ddm/fls/z/ Frame 3299 42 B
401 B 66ms
45ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNS2t6zBqIIDFZXMOwIdfJsD0Q;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNS2t6zBqIIDFZXMOwIdfJsD0Q;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3707620251292.658?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
255 B 35ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-8X79LBSGX3&gtm=45je3b11v9103751878&_p=1699037882581&_gaz=1&gcd=11l1l1l1l1&cid=898914513.1699037883&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1699037884&sct=1&seg=0&dl=https%3A%2F%2Fwww.balatarin.com%2F&dt=%D8%A8%D8%A7%D9%84%D8%A7%D8%AA%D8%B1%DB%8C%D9%86%3A%20%D9%84%DB%8C%D9%86%DA%A9%E2%80%8C%D9%87%D8%A7%DB%8C%20%D9%85%D9%86%D8%AA%D8%AE%D8%A8&en=page_view&_fv=1&_ss=1&_ee=1&up.logged_in=false&tfd=2304
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8X79LBSGX3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.balatarin.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
255 B 50ms
17ms Ping
text/plain 2a00:1450:400c:c03::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-8X79LBSGX3&cid=898914513.1699037883&gtm=45je3b11v9103751878&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8X79LBSGX3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c03::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.balatarin.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 i Show response
www.balatarin.com/analytics/ 0
45 B 368ms
367ms XHR
text/plain 107.178.241.59
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.balatarin.com/analytics/i
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.241.59 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 59.241.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: https://www.balatarin.com/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Fri, 03 Nov 2023 18:58:04 GMT
via: 1.1 google
server: nginx
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 73ms
45ms Image
image/gif 2a00:1450:400e:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-8X79LBSGX3&cid=898914513.1699037883&gtm=45je3b11v9103751878&aip=1&z=820923652

Requested by

Host: www.balatarin.com
URL: https://www.balatarin.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:811::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 57ms
57ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202310310101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4891f59bd7f479f524dee3476aab1bc0a2e8cce7a4984a58bd7ab294f365999a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12111
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 77ms
77ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310310101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 03 Nov 2023 18:58:04 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 35F7 13 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.balatarin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 19084
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 13:40:00 GMT
expires: Sat, 02 Nov 2024 13:40:00 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4E8C 829 B
560 B 17ms
17ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8ed0904cab52afeae809f151bb73998f384f87dc1b6e09d76c4fec29451b1a0f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-VawP19ZPsLWfWEebgKhYCA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.balatarin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-VawP19ZPsLWfWEebgKhYCA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 03 Nov 2023 18:58:04 GMT
expires: Fri, 03 Nov 2023 18:58:04 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame 35F7 38 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 14:48:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14995
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 02 Nov 2024 14:48:09 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4E8C 0
0 40ms
40ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202310310101&jk=3561240333002577&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 35F7 0
10 B 6ms
6ms Image
text/plain 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?2Ab7xg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Fri, 03 Nov 2023 18:58:04 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 19A5 42 B
64 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv5s_cjokw5yywmzsE8clXCCWGpWgP805HHdwnS3fdyUgrtx5YMh1vIrjTpmA0JuY-AlHRSAUyFqFYlDRw6EQn4u9qcRRm-Np8FFNleqvy3O4wFgGK7Xa27EUziB-GWR-fbTMo7TlG8qb9s&sai=AMfl-YSb8M0r1OWDfc8wxunT7txsDpDel7625Hwt0B1K6hN29rZ8S6rnAJsjIacAB1TbQDpQSn9MpNd_4pBH4cVJEKwQ_QL3hNQ4rKr81zqu4w2yByQob3dwpOcIQDw&sig=Cg0ArKJSzGWOm2jd5kszEAE&cid=CAQSOwDICaaNGxi09P7MzLdI8IqShi6KitNgeSC5zgYliZW2jAnZhT2vE84bK8bgkYRWIyolH0Yds-znAalWGAE&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231101&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4223602507&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1699037883530&rpt=227&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2744 42 B
64 B 49ms
49ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst9Hbzmta0ldeZa6Axa-Vpoh6B9hdbU1o16OH7sV5nNksfjFo6i31LjvAFZif5jwvT2xt7Gaw6ybx4OJTjsGx6ZsXRFUx56SdjBPJXxuTnWaXbIM8XRgNFeNusHruBF8jadQ4esMQ0PsLZC&sai=AMfl-YTXWKvfnWVYrxr3Ip1g4iXFbeDkeyT9GxyttZnsHIT5s6oLNPMTBZDHpUlAHOe39SRLFpKkX7uzb_KuaC0A3H3nWCnYVrbLtP7Q_ESp8fGzdHEi1hYTjNV-kVA&sig=Cg0ArKJSzBfox7_cbLMpEAE&cid=CAQSOwDICaaNXKehgG86tLHseP7JeoKi8Fam2jXv5ez5AgsQwJtpVRp50L_QSRsU50G_Zv5KV9L7uyOtHgFgGAE&id=lidar2&mcvt=1001&p=0,0,250,300&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&v=20231101&bin=7&avms=nio&bs=0,0&mc=0.73&if=1&vu=1&app=0&itpl=20&adk=3914965158&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1699037883625&rpt=209&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
44ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202310310101&jk=3561240333002577&bg=!jY6ljsHNAAb4oU7C2KE7ADQBe5WfOJfTYld5WwZcKxnUfTrF9vIZebwy0W9kX0Fqxutnd9JVM-jdar_JNuuUFVJ6jmTpAgAAADxSAAAAA2gBB5kC8tACVzQNpGO3vt55-1ZvEE7fUUvAjwUhZk706m70ldUuxuXXihn86I3lq1B23oVsWYt3kKrg-1oy7Nr6V2G-irWmtKu4MHZxdXqBioZFhXZTv0gSANo5R7euO7TISFMGLxEjL-NsRxo5S0QSBHqfbIxZ-Y01J-lYki3mThCfL0yLUS_AMAG27MHNfHs-HkfRtlTEFf3IxhD8oi1E9x-bz0fYlKutnuadPPNs1aj9u2rrozIyPhTDT8xMdghekabUB3b0eoGYzK13FGdas2zroXfBq18boJaR-z6-_NbrIfibYwZgjDRPhiWk4reXGvZP8ISIt6g9Jv_z_oWtg5qwZNhitdHs8KWdA1nSWfMtgInThjoVhSeDPuGbmeKvm1ZRWWUDGDTPyfIhiZy4pVTg-6ysc9f93XGOaGziDNsafsh34LSG-pq6JWM9SHNpQ11ub6nlujNSPiOHUpUpkbF-nmVuqwyx6kDRI6bx0K__hMzDyiaPauMYzktWolMBOfdJ2Ce-iPkV37VezZR1q37IhKs6w_8eujVG9fEOg721gOgHHyr5srAbryOnTKIgxFG5L5xGSJ1zU4Ittn2RAOcj4FaN4VHnaCafQgprSWziURDrySinZpzdgJPFLdszCxS2rl_AoRfASWVbbXz6gELmxg4ZLI-V6XeycYmPfC-w4Dywin8kCtMRw9HuJdKK15kri6IrlFmEnajUKDzs7VXON8XhKT9VDgbdCvADQcRgRwoo4uP6RTy1F-anFax9T6S-FWHG97-yrUZVoFNQ7PZM9BPVE8vjv_2zGO5w1qAEMpBN0Pep4JRtwacM0Tp5fICSxwA1qH9qG2OA1WzmG5f1srvYTmngQuU5Hbo1iG-4pVKTAC3b1GspX8OXYMq9xdf7NVsG_BE7Nu70vyaYxWYywCc7IKc5gKhH8NI9YjfoWq_qQdOZxfTFgIGp7UQ9dlrhPbMdN1Doy3akvmrEu_LTODrHvWAL1J9yD39zjL4afCZ9qGc
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.balatarin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D072 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=322989734788&version=m202309260101&ct=77&x=1&cor=1154606877951486200

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Nov 2023 18:58:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEJnttfdtyjxvzGCf1afisag&google_cver=1&google_push=AXcoOmTQdEL_Qk0gV-wi1kLsUww7X6wFdd8naD6QcjbJ4fohAYRa5papOA5wOzt7Hs3WljRPT-lpEA9r_0UcGcKuNUun-CeBH9wQc0M

Verdicts & Comments Add Verdict or Comment

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.balatarin.com/analytics	1969-12-31 23:59:59	Name: geo Value: 0
www.balatarin.com/	1969-12-31 23:59:59	Name: _balat_session_new Value: iNDJVOMfuaaOpY8sDE0X0L6QmcheEFlsx9Trge0yrJftD3LYpsVri5HhwVJ9YEVXmObB1n%2F2Ukk6pHxfyMW8wiK6ArVlszlnWo4l3WUIKAlN05mKjO83hhnxTHi%2B9%2FoNtBBjDqRkWz1OfvsG5DoS6vB8fY9pqhZNTUnRcFgtIWb8g2F3MmaPUElTjkeuREM0iSDQErnlhOPRZegAYr6dIKOjyn55bdjpynQS2ef2B%2FoebBkipQlvuOlns5%2BSBLIS5Z7TTbbumeFD3HM%2B52Iq1mTdua2iEEgBzSvevyIbijgl67PCrh%2BxLpKIPgSq0wvHnvLzctmDBmXK%2BxNp35CtbD%2B1rIuF0dJQ5a0oIpd1gvC5%2BJlCllk4wMUbEjHzxtvfqX8vN4tqTwcKwZaFROSShM7VpM9MQw%3D%3D--pWBcEegr2DoWDHhs--quO8n6VPoKstlJS7%2FS0YTQ%3D%3D
www.balatarin.com/	1969-12-31 23:59:59	Name: geo Value: 0
.balatarin.com/	1970-01-21 01:18:53	Name: __gpi Value: UID=00000cb3a430dbd4:T=1699037882:RT=1699037882:S=ALNI_MZO5UBF9ZElIZqELOrdK4oQt_Wzvw
.doubleclick.net/	1970-01-21 01:18:53	Name: IDE Value: AHWqTUmmPCisbPwXvv4aGVjrW0y7PCW5SlT5kNKgSK7aRNxgbrMO2qK0u7BmKrSjt5Q
.balatarin.com/	1970-01-21 01:18:53	Name: __gads Value: ID=1df45741068a73f8-22aadafc25e30044:T=1699037882:RT=1699037883:S=ALNI_MYFrSs6Yo02OrnvEr1O2QqdTUvFHw
.casalemedia.com/	1970-01-21 00:42:53	Name: CMID Value: ZUVCu5HZvqm8cQ5tSTXXTgAA
.casalemedia.com/	1970-01-20 18:06:53	Name: CMPS Value: 5203
.casalemedia.com/	1970-01-20 18:06:53	Name: CMPRO Value: 5203
.adnxs.com/	1970-01-20 18:06:53	Name: uuid2 Value: 8747519662674089818
.adnxs.com/	1970-01-20 18:06:53	Name: anj Value: dTM7k!M41.D>6NRF']wIg2ImTG]o1D!@wnfH8K6pQK`!5=E<L5>xj'4wM_t7)2r9^wteO4L?Lf33Q9HBD?`Dj8c?y%nugO%v4VB%nnuI9NVx
.ctnsnet.com/	1970-01-21 00:42:53	Name: gid_CAESENMNKuGT5MRjMZ1ins-XRvE Value: 1
.ctnsnet.com/	1970-01-21 00:42:53	Name: cid_ccdc2a58c7ad49bd893d81c3bcde22ef Value: 1
.doubleclick.net/	1970-01-20 20:16:29	Name: APC Value: AfxxVi7pY_-DBV2ZbiVxTaLu40Qe-nI7EmuJewVkEQqifHfdII7S2g
.simpli.fi/	1970-01-21 00:44:20	Name: suid Value: 6DB76898629746AD8BFB9AE2347F9B67
.adform.net/	1970-01-20 16:40:29	Name: C Value: 1
.travelaudience.com/	1970-01-21 01:27:32	Name: _tracker Value: %7B%22UUID%22%3A%22E2CBD2D6-22A6-45DE-2680-0CD9D56F61EF%22%7D
.adform.net/	1970-01-20 17:23:41	Name: uid Value: 8191251834147692946
.quantserve.com/	1970-01-20 18:06:53	Name: d Value: EBkBCQGrKoEA
.quantserve.com/	1970-01-21 01:27:32	Name: mc Value: 654542bb-c6496-49fea-1d96a
.doubleclick.net/	1970-01-20 16:40:29	Name: ar_debug Value: 1
.redintelligence.net/	1970-01-20 18:06:53	Name: 8lcfmzhxc8d6_uid Value: d8f1406527de7b0e
.turn.com/	1970-01-20 20:16:29	Name: uid Value: 2377183175791848411
.t23.intelliad.de/	1970-01-20 18:21:17	Name: iact Value: 0001B4AEB18FB3CF4488CA97CDC550BE04FC
.t23.intelliad.de/	1970-01-20 18:21:17	Name: iaimp_42842 Value: 1699037884:42842:100:137:101:248:101:202311031858041265313b9e36f345
pb.media01.eu/	1970-01-21 01:33:17	Name: DTU Value: 134FCB20694C6CB4CACB8EF9C0A26A04
.yahoo.com/	1970-01-21 00:43:15	Name: A3 Value: d=AQABBLxCRWUCEGLp2Qzo1udM7J6h8FnaHFIFEgEBAQGURmVPZQAAAAAA_eMAAA&S=AQAAAhNSscsPAsU0EYfi65ZyDHY
.balatarin.com/	1970-01-21 01:33:17	Name: _ga_8X79LBSGX3 Value: GS1.1.1699037884.1.0.1699037884.60.0.0
.balatarin.com/	1970-01-21 01:33:17	Name: _ga Value: GA1.1.898914513.1699037883
.tribalfusion.com/	1970-01-20 18:06:53	Name: ANON_ID Value: aDnt6ZarwZaybQXwrSPPrCKcigHfeLvZadB7rfjvg0tmA0S3Pi82ZaQqraUIUhvA6cEJVWOXywH7AOv1uY4906VqDtjxSSSH

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556952; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
a.tribalfusion.com
ad.doubleclick.net
ad.turn.com
ads.travelaudience.com
adservice.google.com
ajax.googleapis.com
assets.balatarin.com
c1.adform.net
cm.g.doubleclick.net
cms.quantserve.com
dclk-match.dotomi.com
dis.criteo.com
dsum-sec.casalemedia.com
ec2a47f34a564aae26f22e5e536bf217.safeframe.googlesyndication.com
fonts.googleapis.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
hal9000.redintelligence.net
hal90004.redintelligence.net
ib.adnxs.com
img.youtube.com
ius.ctnsnet.com
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pb.media01.eu
pr-bh.ybp.yahoo.com
pv.medialead.de
r.turn.com
region1.analytics.google.com
s.tribalfusion.com
s0.2mdn.net
s3.amazonaws.com
securepubads.g.doubleclick.net
stats.g.doubleclick.net
sync.teads.tv
t23.intelliad.de
tpc.googlesyndication.com
um.simpli.fi
www.balatarin.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
z-na.amazon-adsystem.com
googlecm.hit.gemius.pl
107.178.241.59
138.201.63.116
142.250.184.194
142.250.186.34
142.250.186.38
145.239.193.130
172.64.151.101
178.250.1.9
178.63.52.121
185.89.210.212
2001:4860:4802:32::36
23.43.61.33
2606:4700::6812:19ad
2620:116:800d:21:7eb1:3826:be7e:d981
2a00:1450:4001:803::200e
2a00:1450:4001:806::2002
2a00:1450:4001:806::2008
2a00:1450:4001:808::2002
2a00:1450:4001:808::2006
2a00:1450:4001:80e::2001
2a00:1450:4001:80e::2002
2a00:1450:4001:810::2004
2a00:1450:4001:813::2002
2a00:1450:4001:828::200a
2a00:1450:4001:829::2002
2a00:1450:4001:82b::2001
2a00:1450:4001:830::200a
2a00:1450:4001:831::2002
2a00:1450:400c:c03::9a
2a00:1450:400e:811::2003
2a02:fa8:8806:13::1400
2a05:d018:d29:3602:15eb:19d4:d59:9b24
3.126.125.13
35.157.49.61
35.186.193.173
35.190.0.66
35.204.74.118
37.157.6.243
46.228.164.11
51.75.86.98
52.217.17.238
52.222.166.41
52.84.174.27
88.198.250.30
03d5c445fbf76b8749bdac185d39ee6f2255ba15d67c66f10a7c69d978ac3faf
07d9be34265b21369f9e842b6f14032ca51803bc359df6994ca7f69bc29c1567
0b82f6ba50e20af1cb331d1c2a706e2e0c6e7236ae08093705d10f1f94b9dda0
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0e84c29fa36d8c5f38189f379f60ec78a164cbe01bcd27e5443d6aedf4e4748d
11435640d1ed2fa5f24ccd7f074b66c4d191a97a2931e793be6799d2b6a5e459
12080a1c23dc342aafdbe5a5643fb9c24204f8b5f092e190236af52f152f6a48
17f83a1ecedecae8428995c7dd273ce075247a0331829b1e1b11284c1a116fd9
19e0525fa11d2620399eb4bff91f8956f6ee34e1bcc360fda3e30f189b8972a4
1b99f283b471969876544d503423e928da8e8ba17d09fa9cebe6e2ea74aa3511
1dca71ae85c56128fae9a00cf93d9336ce64542c349b8dfbee61443044a341fa
21f9929be70d12eee913203bc3848ffa3f7865b4d74ddac987dad368a08fd6da
268074f768701b86b9486b3950d49c5029cc03eaaa596a9ea086350c4412b1d8
27673d77d9a3a48218eddaefec11b6d9e9cfe5b91090f652485bbdfe38f7702d
2804a62f734cf592c4a5def92b3de38ea8a2acfb1fbb6aa95c736682cc87c6d2
28d76b4a4ec9614dc564bef56c3ec33515fa57b82066b06b9a06bd248a9ddb0d
2a28c1e44911a819f36aadfbcb300bd91a1da929ae8a63840ea2aef62cf915b0
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b53d225259d5287c25e8716fc0e9216046ab6ffab29c5e78922a41f515f1514
2be701f18dc8f0aebd70159d876b7dbe53770360ed7739abbf6b41a91d0773ba
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3a9eb186c2c4bfd02940bf4ff9dfe8f92315a940caf688f01b24bc56d3f098de
3c0a54c4739533ca549e95dc9dbbe6b261e18652c8a4b04faca1acee8f864756
41e11c9e96c67d8e76c1421a8bbfb74beebba93f4c14de35b261707c90976ae1
4281341b05f1697c034074009e6bdd567ef0927232a21698b1f8149a5247c301
4310f844f0e1527b87404aac978e04719093450ba00c9b9f38af330939e62e3a
43148c46e3ce875a4ef8bf45f9f9ea3efefa07450d0277758d61e17ed2428b33
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
43cbe861b09360a856de530e3aac37acab9201d0eb166c906b26e0f71fc6ff23
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
46b2dc3fc5e9ccbcde38dfcc96d4545befae794ae947ea3602693f2e7126b057
473d889b2e7148550316947a833cc23762d90bf7435ec4635afef1d9fe23970d
4891f59bd7f479f524dee3476aab1bc0a2e8cce7a4984a58bd7ab294f365999a
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
493a4ee10da56f9c836699e31ab3234bd30e15205ee5c12a10d9f7eeafa21376
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e59e06c7f416ca4193a16a7ea5127a0fb277b7da0923a84ebd54e0f4c01923e
5274718f391114e7202c44cd51531a9c25857e8779796703252cafd10de8db5e
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
58919c2c49365f16eceb81812474ac866c47055f1855135ab35f940c2730cb35
5b1979a4ecb584da673a08d6a737a10d87ae84aa6f5c2d18ab97da15c7462f11
5d216925e31ef785633d07b92985e143557cdb5ae453244ba3abe431018eb9c3
5f811c2f6c3fab2007917f5a3826fc947f3d11ee2ef0f3cf7ef6d6200af8e2aa
6046c8481b852fe24067c203ca71a0d0b04dd4f5e364c7ebba3c7acb998a993b
60569433b50ff6d836d1783ba1b8d71d62f86c069d45c599fa16211336f9242b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1
627f42a8d624a3cf8d46cc94afd628596b0a5f8ffa8c8558959398581d45fb26
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
69f2dd5a1d2db981d91b2cb9a239d9ed6a25c614a3decf75aa8e94af182fc6d9
6ae03a9f3ce2f04813b6fa58a8d0f093caa85c01f1a4183cc2a625be1dee814c
6b4c09c853d4c1b0139484034b53aafa8706cf3f1962b1f1dbe1dfd9f7d14c1c
6ba0d41886d2bd37da3c6f34107fa0e92399b1cef61d6d0f2856fa38bc5f6a9b
6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc
6f5efcf297ccba73d6cd3ce25a82cec1dca3385b3019c8ed06275c7f45c73ac9
713aef7883e58ad15857e8cae3d34335ab309882218fed5147cb558dd0d4877c
73dbaad7ff53afb9724f6a9e337b1d92ca4d0f23604a26340e141bedb1034179
74bafe634fa74d1022730eb10d68f83eaa23ed09243423e9e0b7b0712826a5c3
77a9569403b6c090b10b0903da228e132b27b8e24c59be4eecb14e8e1b3a7fbe
7bc6dccb63d003252141ea84540a8a0ebabf143b1828063cec2a34bea8ca8150
810a4b6938999adb1ab79d3e1da4b415fcbc377a47979a83a03c3fc920433770
82dcc5d3b76b02619e6d68742a9ae39eee3c3a773530c2b655e654071fb3b2dd
8addc6dcf37a5afc07920bd30497d2948bbd912f73af9fb44bc7dda4ce1fd864
8d12e48a7e782a82ef6280881eb2ceb75b939a57448c294b4396ae50fae34fdf
8ed0904cab52afeae809f151bb73998f384f87dc1b6e09d76c4fec29451b1a0f
926e76861bd88a9da8f9522ee2bec8223494828c3f9d375b2421d10101081106
961f547cdb29f79eed49fddf9c4867b1f8589facfe487d6055c512950db7a914
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9cc4bd778c6a763f2d0aa09e54ca117e54772b4f9d87f6447d289ac9e0eefa51
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a07ff97c13e48e9fe2da98979cebdcb6904f96c414ba093b17e050c0a697e271
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a247c99a78ea116295aa3f59a80167e092af8c23776f3d3c09e805d365d766a4
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
a7b6ac83d0a5dbb3a50fb28ff292d09cdd262834c50beb293d9aad1550eac5a1
a965b3e5c3976c06f59fd036231b746c1b0345b0aea5043f177856c3af40e7a3
aa38115ab496b6f1eba6105087c95e485c36be8293c750ad49e8c5ec44e291e8
ad5cfdcee3dc7025ae2e47eb626092c3f8e69928ee6909ed8d83cf14f87a3dc2
ae9114286e948928f5dc578981a2d4c2e968ed8dde80d5106d66b6ee62a586d4
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3390fb9855914c762c445b520c6f99986a6d72321773c32af53fea7fbbbbbd2
b36aa547e8e485976ad022c8b097bf98f045634aff31f9c8cae0aea0f0cd9cea
ba8f1261d5b5aaf9c05d6879886b7c04a10cc1165210ecd1b826272ee54370e7
bba2d5622e1a33c1bd924e07f396c234a390f0bf9bb5fd1394521df422ad3607
bcc835b2ee6597ab452678ef74797dc233b9a95e352ca4d367f733f0aa1ba2dd
bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2
c067cb7a26be0a90f3ebf4f385f5220b95618faf05ebb49178c7e1f5e4f16bcd
c294c65db9b2c64c66eb2e7321e99650fec8f33ac8cf01bfa996a1680fc0c702
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
c6042222156b5e26db18d7a25025e4b71e9c1d3d4cf90793e4030154b2dea1f5
ca899679eac9e707d4cfdf4a200b35ff18ce29cc0ff7462f4082d6d06dc30cef
cc6aaa0fa32d21150815dc89592f165779dbdde4c2d8954b497422bac422f970
cd7c78c36287bd87d210152bcada1a602d0daf414497c4fcc55ceed1fb2a2edf
d2892bbf85a629d03f004557d6e0aefbe97699a83336eda44d380f4d2fddd3bf
d8d14f1416a5c7f640cdbe97359aba78652e4b7a7aad916f3186c07979833748
e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e454d5ada0ee387ca2095aa0f3aa9471dadf0cc2f7518f78c640b63d981502af
e581c3bf6f9547d2b323c8e1ab6546470435b69417d12984bc0fb08c90307112
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5aedc8850b65270522a00e0f6a65196ec804be7ae19531af2b137cd0df7ac30
e6cdb7a81b23ab5cd13f0cdc9f0b6499db70b123160317b17c27d7acfa9e0ebf
e8cf20f6e98c91ff5a877209649b0839bb06e5751793babfb0dbbbb60a9e811a
e9292378c34069e5a89179aae753b399421de949e17bba27ef8c2d1336904ee0
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ed54e78c5e850018b5000dc2743ee2c6a9111933f827da8dda8f26414cbcd024
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2a78ec0800976a7fbcd2f14881e6be9588f6f95d7e2ebcae41236f6ecfe3206
f3879cbf119d2a99d9badd2bff1fa3d39b35264fee9453ed22b49f3b7dc3ef8d

www.balatarin.com Open in urlscan Pro 107.178.241.59 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

206 Requests

86 %HTTPS

48 %IPv6

33 Domains

48 Subdomains

39 IPs

9 Countries

2424 kBTransfer

5699 kBSize

30 Cookies

24 Outgoing links

Page URL History

Redirected requests

206 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.balatarin.com Open in urlscan Pro
107.178.241.59 Public Scan

Screenshot
Live screenshot

Full Image

206
Requests

86 %
HTTPS

48 %
IPv6

33
Domains

48
Subdomains

39
IPs

9
Countries

2424 kB
Transfer

5699 kB
Size

30
Cookies

206 HTTP transactions
6 data transactions