www.dailyfaceoff.com Open in urlscan Pro
2606:4700:10::ac43:7b0 Public Scan

Software

nginx/1.21.3 /

Resource Hash

af73bc60ca28a31d86c8090b69c684f6a07ee624b4a048efd5af4cd49604586e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
an-x-request-uuid: be9571eb-e864-420b-ac27-52c466d9a654
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 143
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
162 B 187ms
99ms XHR
text/plain 3.126.163.234
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.163.234 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-163-234.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:25 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 5 KB
3 KB 170ms
111ms XHR
application/json 216.52.2.30
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.54.3
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 New York, United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: c718009cf83f5b2de9ccc52e7b8d0c7f8ad3dcfb965a6ac190ec346a4901fc3f

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 27 Oct 2023 22:03:25 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.dailyfaceoff.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 2490

POST
H2 200 / Show response
shb.richaudience.com/hb/ 4 B
240 B 73ms
19ms XHR
text/html 157.90.3.144
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://shb.richaudience.com/hb/
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 157.90.3.144 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.144.3.90.157.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: d6dffe998d4d52601dd56a1666bbd09f6926bc110429c434402ca7a814080808

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
server: nginx/1.14.2
vary: Accept-Encoding, Accept-Encoding
access-control-max-age: 86400
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
117 B 81ms
31ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:23 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
562 B 355ms
98ms XHR
application/json 185.86.138.122
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:24 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H2 200 prebid Show response
mp.4dex.io/ 60 B
401 B 56ms
29ms XHR
application/json 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77b47b7a038f38916adbe760bc262fe2aa75e9f2a0d67621d19ad74e41acdb39

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
x-err: Shapings: no adunits with size and seat and mapping
x-version: 3.0.0-gcp-ams
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
content-encoding: gzip
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 81ce3a9b2f0c37da-FRA
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 387 B
916 B 170ms
96ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=14194&site_id=405436&zone_id=2272718&size_id=15&rf=https%3A%2F%2Fwww.dailyfaceoff.com%2F&tg_i.domain=dailyfaceoff.com&tg_i.page=https%3A%2F%2Fwww.dailyfaceoff.com%2F&tg_i.pbadslot=%2F63317524%2Fdfo%2Farticles%2Fboxbanner_right--pb-slot-right-1&tk_flint=pbjs_lite_v7.54.3&x_source.tid=c43223e6-eeda-4b25-b274-81930561a4de&l_pb_bid_id=1688492009f954&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=c43223e6-eeda-4b25-b274-81930561a4de&rp_maxbids=1&slots=1&rand=0.22635822267466033
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 8c83b9857077961a37ae8bdf9d1387abe6f1dcbe9de7d476271bb2c73c6af675

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 387
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
199 B 89ms
23ms XHR
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=7.54.3&cb=81992551008&lsavail=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:24 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
967 B 208ms
174ms XHR
application/json 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-35-156-243-142.eu-central-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

ee518897d1c978ec75514fa74f4250ac3ee6164bc9625ba044042276d07c8fcd

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
an-x-request-uuid: cbbde469-a74f-48cf-9a0e-26b516af293e
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
531 B 149ms
87ms XHR
application/json 35.156.243.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.54.3&referrer=https%3A%2F%2Fwww.dailyfaceoff.com%2F&tmax=2500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.156.243.142 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
accept-ch: sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
434 B 118ms
34ms XHR
application/json 54.171.212.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.171.212.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-212-190.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: da97b58476f441539800577d0d4e1a5940c63ace844961be0993e1a0ba999fee

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 84

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
262 B 71ms
15ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 00a54e9d080a2f18c8af7ef85a96f6c25f4cb17352f050ff91abb37cbb606065

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
556 B 156ms
101ms XHR
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=923189
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b61c56f7865331545d46697d49e6f08ecf17aec054fb4765394c685d72b8c82

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UxuX1cNrwWVzrS8w5AQf3cSZQlqInDfOC5kBJB2a%2FlV%2Fe%2FEnxgLPXH2Qq8sUop%2FoV8vtwLvR5aRC2wy%2FUvLsRp%2B%2FWsyJhnNVQFysoILCG21Ed15mGnNeZLT3rStTGuiKpbwjMrT4"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 81ce3a9b7965bbd4-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 21 KB
5 KB 244ms
161ms XHR
application/json 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 3b5c22b1f5551a2c3481a1f3ee1aa6f5e6525598423350ce528f075ac2f240f4

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 146
content-length: 4888

POST
H2 204 prebid Show response
krk2.kargo.com/api/v1/ 0
503 B 67ms
13ms XHR
text/plain 3.126.229.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk2.kargo.com/api/v1/prebid
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.229.145 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-229-145.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
x-accel-expires: 0
accept-ch: Sec-CH-UA,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
nbr: 508
vary: Accept-Encoding
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
krk-no-bid-reason: consent
expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 200 hb-mm-multi Show response
hb.minutemedia-prebid.com/ 105 B
456 B 140ms
31ms XHR
application/json 54.171.212.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.171.212.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-212-190.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 3093a5eb02b0d59e0510730bb6b6a8515942fe212b9ccd5e85ed9cab9266caec

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 40ms
9ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1721740624799960&ev=PageView&dl=https%3A%2F%2Fwww.dailyfaceoff.com%2F&rl=&if=false&ts=1698444205322&sw=1600&sh=1200&v=2.9.136&r=stable&ec=0&o=4126&fbp=fb.1.1698444205314.1437328195&cs_est=true&ler=empty&it=1698444204876&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 27 Oct 2023 22:03:25 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 primisslate.css
live.primis.tech/content/video/css/ 18 KB
7 KB 19ms
18ms Stylesheet
text/css 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/css/primisslate.css
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: dcbb76a8cb268e3ed25b14f8d4a9b8e906f20da34d903111c2d77fc2c34d83cc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
last-modified: Mon, 05 Jun 2023 10:07:38 GMT
server: nginx
x-amz-cf-pop: FRA60-P3
etag: W/"647db3ea-469b"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
x-amz-cf-id: sghSpab8z_RquwoZqZAYYoqyun5vrpjJFN4SKu2MA7P8V7MOkO63TQ==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 3EF7 264 KB
65 KB 15ms
14ms Script
application/javascript 13.224.89.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.89.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-83.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 039a2d3b0a025c36845720df9d5d8253ed0accd2b7e37cb76c6d2d8cc137e7b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 21:35:36 GMT
content-encoding: gzip
via: 1.1 142ded88048f806cc40a5a225130cc8a.cloudfront.net (CloudFront), 1.1 110750d14d1d900cd5c76d0ac872f5dc.cloudfront.net (CloudFront)
last-modified: Tue, 24 Oct 2023 21:00:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, ZRH50-C1
age: 1670
x-amz-server-side-encryption: AES256
etag: W/"f90f24d20b0a1f80ef986c97a9726a2b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: MMGsbyWy8ufxtnglKGBB6ONFbDT5Ry9F38jnUwsRAECY2Yrh5bB4cA==

GET
H2 200 css
fonts.googleapis.com/ Frame E44C 2 KB
681 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 27 Oct 2023 20:59:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 27 Oct 2023 22:03:25 GMT

GET
H3 200 css
fonts.googleapis.com/ 2 KB
585 B 19ms
18ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 27 Oct 2023 21:08:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 27 Oct 2023 22:03:25 GMT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 3EF7 139 KB
14 KB 67ms
66ms XHR
application/json 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMSUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMTM2OCUlRaZcZGViXmYmZwYmMGJzZwAkZzQjNDx2NDMkMTAyMxZ2nWQ2NTNvMWFyMmNwYTZvNTU4MTMmMDE4Lz1jNCUmRaRinlUmRGV3o2qJQ0FaSW1Gp1c5STZJQ0cJVXcJMU5cSXNDnUFaSUNBnWRIoHqJnz9aSWgjWFZDSUgzUS5yq29aSUNBZ0ygoHcwrUx2SUNKUWNgoHRuWE1cTEFiZ0yDQWqJox4kWWyJNxyDSXZxWEJmYwJGn2N5OWcvnxV2ZG1fn1cXOHZxWE5fY25NqyxlOXVxoVZ5ZEqWn0k6TXuNryx0TDNnpFcHVaZYryy6WzcZrx1HSz1nnxF4Wz1Rq05EnmJORE14TVRBqzRgoGgOnyV6WWcGnFcUTXcZMxUlWWcVMU9ERXcNrxF4T0M1qGNEUWyMQW9aSUNBZ0ygNWynnUx2SURFMx9UZmBOREEjTURBp0NcQWqJQ0FcWyubq0ydo2qNVFx1T0RZME1En3yNQXA5Ly81pF9JSGUmX2RMpUqEREkapzRMTzysWauPYVJRWFE4S2gToVRPTGxjo0EzqzyxX2NioaRyoaRsnWQ9Mmp4MTt5MlZ2nWRsY29hqGVhqF9xZXNwPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X3RcqGkyPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X2R1pzF0nW9hPTEjMlZjoGFwZW1yoaRTqHJyYW1UrXByPTEzZGVvqWqJozZipz1uqGyiow0zpGkurWkcp3RJZD0kNDEjNvZ4PTY1NvZ5PTM2OSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMmMxQmMTMjMxQmMwM4NUYmMDMkN0Q3QwpmMmEmNmMlMmUmNTM1MmQmMDqEN0I0MmM1Mmp3RDqCNTM2NDMmNwQmMmRDNxQ1MwY4NwE1Nmp4MmU1QTZENDY2QTVBNTpmOTZENUE2OTM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwM0MmA3RDqCNTxmNDM0MmA3RDqCNwYmMTqEN0I0QmMkMmpmMmMlMmY3REZFRxUzYXBjTzFgZT0znXNBpHA9MCZupHBJZD0zZGyunWQ9JzFjpEJ1ozRfZUyxPWu0qHBmJTNBJTJGJTJGq3q3LzRunWk5ZzFwZW9zZv5wo20yMxYzYXBjU3RipzVVpzj9JzFjpFBlnXZuY3yQo2kcY3x9JzFjpEymUGFcZD0zYXBjVzVlp2yiow0zp2Reqw0zYXBjRGV2ZWkipGVlPSZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGMTE4LwAhNTx5Ml4kMTpeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZuqzFcoENuoXBunWqhpm0znXNBpHBKpm0jJzNmqXVcZD02NTNwMmNuY2I2ODt3JzNvqXN0ZXI9MTY5ODQ0NDIjNTU4MvZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032332D31302D32385F30317D7B7331373235353534307D7B4335377D7B53643364334C6D5268615778355A6D466A5A57396D5A69356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583634307D7B593434307D7B66317D7B4C31373332367DFEFE&userIpAddr=2001%3Aac8%3A20%3A3a00%3A1012%3Ad5e0%3Aa20f%3A6753&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F118.0.5993.117+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=22&c2pWaitTime=10&sdkv=&isSinglePageFloatSupport=1&availCampaigns=&isAmpIframe=0&tagKeywords=&cbuster=1698444204&csuuid=653c33acb6887&debugInfo=17255540_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=17255540&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed371ausxnwiyz&secondaryContent=&x=640&y=440&pubUrl=https%3A%2F%2Fwww.dailyfaceoff.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=17326&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=&appName=&appBundleId=https%3A%2F%2Fwww.dailyfaceoff.com%2F&appStoreUrl=&diaid=&appPrivacyPolicy=&appIsPaid=&appDeveloper=&appId=&appVersion=&sdkv=&enableResizeObserverInapp=0&isAppJs=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 21eec8e1c1f559cc6e31e5077ac9d5596162f36d38a13273274ca5e107e32de7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json; charset=utf-8
cache-control: no-store
access-control-allow-credentials: true
content-length: 13504
x-amz-cf-id: CeKibk_JJXiOHN0QQtgtY9I-ZVO-nQ80jqd4HpOfJmiOtjuRvloHgg==

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 3EF7 64 KB
9 KB 47ms
46ms XHR
application/json 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMSUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMTM2OCUlRaZcZGViXmYmZwYmMGJzZwAkZzQjNDx2NDMkMTAyMxZ2nWQ2NTNvMWFyMmNwYTZvNTU4MTMmMDE4Lz1jNCUmRaRinlUmRGV3o2qJQ0FaSW1Gp1c5STZJQ0cJVXcJMU5cSXNDnUFaSUNBnWRIoHqJnz9aSWgjWFZDSUgzUS5yq29aSUNBZ0ygoHcwrUx2SUNKUWNgoHRuWE1cTEFiZ0yDQWqJox4kWWyJNxyDSXZxWEJmYwJGn2N5OWcvnxV2ZG1fn1cXOHZxWE5fY25NqyxlOXVxoVZ5ZEqWn0k6TXuNryx0TDNnpFcHVaZYryy6WzcZrx1HSz1nnxF4Wz1Rq05EnmJORE14TVRBqzRgoGgOnyV6WWcGnFcUTXcZMxUlWWcVMU9ERXcNrxF4T0M1qGNEUWyMQW9aSUNBZ0ygNWynnUx2SURFMx9UZmBOREEjTURBp0NcQWqJQ0FcWyubq0ydo2qNVFx1T0RZME1En3yNQXA5Ly81pF9JSGUmX2RMpUqEREkapzRMTzysWauPYVJRWFE4S2gToVRPTGxjo0EzqzyxX2NioaRyoaRsnWQ9Mmp4MTt5MlZ2nWRsY29hqGVhqF9xZXNwPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X3RcqGkyPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X2R1pzF0nW9hPTEjMlZjoGFwZW1yoaRTqHJyYW1UrXByPTEzZGVvqWqJozZipz1uqGyiow0zpGkurWkcp3RJZD0kNDEjNvZ4PTY1NvZ5PTM2OSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMmMxQmMTMjMxQmMwM4NUYmMDMkN0Q3QwpmMmEmNmMlMmUmNTM1MmQmMDqEN0I0MmM1Mmp3RDqCNTM2NDMmNwQmMmRDNxQ1MwY4NwE1Nmp4MmU1QTZENDY2QTVBNTpmOTZENUE2OTM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwM0MmA3RDqCNTxmNDM0MmA3RDqCNwYmMTqEN0I0QmMkMmpmMmMlMmY3REZFRxUzYXBjTzFgZT0znXNBpHA9MCZupHBJZD0zZGyunWQ9JzFjpEJ1ozRfZUyxPWu0qHBmJTNBJTJGJTJGq3q3LzRunWk5ZzFwZW9zZv5wo20yMxYzYXBjU3RipzVVpzj9JzFjpFBlnXZuY3yQo2kcY3x9JzFjpEymUGFcZD0zYXBjVzVlp2yiow0zp2Reqw0zYXBjRGV2ZWkipGVlPSZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGMTE4LwAhNTx5Ml4kMTpeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZuqzFcoENuoXBunWqhpm0znXNBpHBKpm0jJzNmqXVcZD02NTNwMmNuY2I2ODt3JzNvqXN0ZXI9MTY5ODQ0NDIjNTU4NvZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032332D31302D32385F30317D7B7331373235353534307D7B4335377D7B53643364334C6D5268615778355A6D466A5A57396D5A69356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583634307D7B593434307D7B66317D7B4C31373332367DFEFE&userIpAddr=2001%3Aac8%3A20%3A3a00%3A1012%3Ad5e0%3Aa20f%3A6753&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F118.0.5993.117+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=22&c2pWaitTime=10&sdkv=&isSinglePageFloatSupport=1&availCampaigns=&isAmpIframe=0&tagKeywords=&cbuster=1698444204&csuuid=653c33acb6887&debugInfo=17255540_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=17255540&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed371ausxnwiyz&secondaryContent=&x=640&y=440&pubUrl=https%3A%2F%2Fwww.dailyfaceoff.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=17326&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=&appName=&appBundleId=https%3A%2F%2Fwww.dailyfaceoff.com%2F&appStoreUrl=&diaid=&appPrivacyPolicy=&appIsPaid=&appDeveloper=&appId=&appVersion=&sdkv=&enableResizeObserverInapp=0&isAppJs=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6de70cd3ab2a39395bf25cfc37abd5994e25c9be96e73de4d0dfe60c635630af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:24 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json; charset=utf-8
cache-control: no-store
access-control-allow-credentials: true
content-length: 8480
x-amz-cf-id: 5UDVyjBfalQ61bbBV1KbObdLTvg9csnsp1M0a-urIYJf2Q12nMJykg==

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 3EF7 157 KB
15 KB 61ms
60ms XHR
application/json 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMSUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMTM2OCUlRaZcZGViXmYmZwYmMGJzZwAkZzQjNDx2NDMkMTAyMxZ2nWQ2NTNvMWFyMmNwYTZvNTU4MTMmMDE4Lz1jNCUmRaRinlUmRGV3o2qJQ0FaSW1Gp1c5STZJQ0cJVXcJMU5cSXNDnUFaSUNBnWRIoHqJnz9aSWgjWFZDSUgzUS5yq29aSUNBZ0ygoHcwrUx2SUNKUWNgoHRuWE1cTEFiZ0yDQWqJox4kWWyJNxyDSXZxWEJmYwJGn2N5OWcvnxV2ZG1fn1cXOHZxWE5fY25NqyxlOXVxoVZ5ZEqWn0k6TXuNryx0TDNnpFcHVaZYryy6WzcZrx1HSz1nnxF4Wz1Rq05EnmJORE14TVRBqzRgoGgOnyV6WWcGnFcUTXcZMxUlWWcVMU9ERXcNrxF4T0M1qGNEUWyMQW9aSUNBZ0ygNWynnUx2SURFMx9UZmBOREEjTURBp0NcQWqJQ0FcWyubq0ydo2qNVFx1T0RZME1En3yNQXA5Ly81pF9JSGUmX2RMpUqEREkapzRMTzysWauPYVJRWFE4S2gToVRPTGxjo0EzqzyxX2NioaRyoaRsnWQ9Mmp4MTt5MlZ2nWRsY29hqGVhqF9xZXNwPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X3RcqGkyPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X2R1pzF0nW9hPTEjMlZjoGFwZW1yoaRTqHJyYW1UrXByPTMzZGVvqWqJozZipz1uqGyiow0zpGkurWkcp3RJZD0kNDEjNvZ4PTY1NvZ5PTM2OSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMmMxQmMTMjMxQmMwM4NUYmMDMkN0Q3QwpmMmEmNmMlMmUmNTM1MmQmMDqEN0I0MmM1Mmp3RDqCNTM2NDMmNwQmMmRDNxQ1MwY4NwE1Nmp4MmU1QTZENDY2QTVBNTpmOTZENUE2OTM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwM0MmA3RDqCNTxmNDM0MmA3RDqCNwYmMTqEN0I0QmMkMmpmMmMlMmY3REZFRxUzYXBjTzFgZT0znXNBpHA9MCZupHBJZD0zZGyunWQ9JzFjpEJ1ozRfZUyxPWu0qHBmJTNBJTJGJTJGq3q3LzRunWk5ZzFwZW9zZv5wo20yMxYzYXBjU3RipzVVpzj9JzFjpFBlnXZuY3yQo2kcY3x9JzFjpEymUGFcZD0zYXBjVzVlp2yiow0zp2Reqw0zYXBjRGV2ZWkipGVlPSZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGMTE4LwAhNTx5Ml4kMTpeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZuqzFcoENuoXBunWqhpm0znXNBpHBKpm0jJzNmqXVcZD02NTNwMmNuY2I2ODt3JzNvqXN0ZXI9MTY5ODQ0NDIjNTU4NlZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032332D31302D32385F30317D7B7331373235353534307D7B4335377D7B53643364334C6D5268615778355A6D466A5A57396D5A69356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583634307D7B593434307D7B66317D7B4C31373332367DFEFE&userIpAddr=2001%3Aac8%3A20%3A3a00%3A1012%3Ad5e0%3Aa20f%3A6753&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F118.0.5993.117+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=22&c2pWaitTime=10&sdkv=&isSinglePageFloatSupport=1&availCampaigns=&isAmpIframe=0&tagKeywords=&cbuster=1698444204&csuuid=653c33acb6887&debugInfo=17255540_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=17255540&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed371ausxnwiyz&secondaryContent=&x=640&y=440&pubUrl=https%3A%2F%2Fwww.dailyfaceoff.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=17326&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=&appName=&appBundleId=https%3A%2F%2Fwww.dailyfaceoff.com%2F&appStoreUrl=&diaid=&appPrivacyPolicy=&appIsPaid=&appDeveloper=&appId=&appVersion=&sdkv=&enableResizeObserverInapp=0&isAppJs=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: cfebadc922e70c97b28be4d1cf1e3c4d8798c8111594f2dc38852fae9b7f8641

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json; charset=utf-8
cache-control: no-store
access-control-allow-credentials: true
content-length: 14768
x-amz-cf-id: 2mrqQJWDdSFA7qeP_yQ0B7YmQakIPrJ-WUCKJIT7CNAEZATFLUac3g==

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 3EF7 148 KB
14 KB 80ms
80ms XHR
application/json 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMSUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMTM2OCUlRaZcZGViXmYmZwYmMGJzZwAkZzQjNDx2NDMkMTAyMxZ2nWQ2NTNvMWFyMmNwYTZvNTU4MTMmMDE4Lz1jNCUmRaRinlUmRGV3o2qJQ0FaSW1Gp1c5STZJQ0cJVXcJMU5cSXNDnUFaSUNBnWRIoHqJnz9aSWgjWFZDSUgzUS5yq29aSUNBZ0ygoHcwrUx2SUNKUWNgoHRuWE1cTEFiZ0yDQWqJox4kWWyJNxyDSXZxWEJmYwJGn2N5OWcvnxV2ZG1fn1cXOHZxWE5fY25NqyxlOXVxoVZ5ZEqWn0k6TXuNryx0TDNnpFcHVaZYryy6WzcZrx1HSz1nnxF4Wz1Rq05EnmJORE14TVRBqzRgoGgOnyV6WWcGnFcUTXcZMxUlWWcVMU9ERXcNrxF4T0M1qGNEUWyMQW9aSUNBZ0ygNWynnUx2SURFMx9UZmBOREEjTURBp0NcQWqJQ0FcWyubq0ydo2qNVFx1T0RZME1En3yNQXA5Ly81pF9JSGUmX2RMpUqEREkapzRMTzysWauPYVJRWFE4S2gToVRPTGxjo0EzqzyxX2NioaRyoaRsnWQ9Mmp4MTt5MlZ2nWRsY29hqGVhqF9xZXNwPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X3RcqGkyPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X2R1pzF0nW9hPTEjMlZjoGFwZW1yoaRTqHJyYW1UrXByPTMzZGVvqWqJozZipz1uqGyiow0zpGkurWkcp3RJZD0kNDEjNvZ4PTQjMCZ5PTIlNSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMmMxQmMTMjMxQmMwM4NUYmMDMkN0Q3QwpmMmEmNmMlMmUmNTM1MmQmMDqEN0I0MmM1Mmp3RDqCNTM2NDMmNwQmMmRDNxQ1MwY4NwE1Nmp4MmU1QTZENDY2QTVBNTpmOTZENUE2OTM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwM0MmA3RDqCNTxmNDM0MmA3RDqCNwYmMTqEN0I0QmMkMmpmMmMlMmY3REZFRxUzYXBjTzFgZT0znXNBpHA9MCZupHBJZD0zZGyunWQ9JzFjpEJ1ozRfZUyxPWu0qHBmJTNBJTJGJTJGq3q3LzRunWk5ZzFwZW9zZv5wo20yMxYzYXBjU3RipzVVpzj9JzFjpFBlnXZuY3yQo2kcY3x9JzFjpEymUGFcZD0zYXBjVzVlp2yiow0zp2Reqw0zYXBjRGV2ZWkipGVlPSZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGMTE4LwAhNTx5Ml4kMTpeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZuqzFcoENuoXBunWqhpm0znXNBpHBKpm0jJzNmqXVcZD02NTNwMmNuY2I2ODt3JzNvqXN0ZXI9MTY5ODQ0NDIjNTU4OCZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032332D31302D32385F30317D7B7331373235353534307D7B4335377D7B53643364334C6D5268615778355A6D466A5A57396D5A69356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583634307D7B593434307D7B66317D7B4C31373332367DFEFE&userIpAddr=2001%3Aac8%3A20%3A3a00%3A1012%3Ad5e0%3Aa20f%3A6753&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F118.0.5993.117+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=22&c2pWaitTime=10&sdkv=&isSinglePageFloatSupport=1&availCampaigns=&isAmpIframe=0&tagKeywords=&cbuster=1698444204&csuuid=653c33acb6887&debugInfo=17255540_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=17255540&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed371ausxnwiyz&secondaryContent=&x=640&y=440&pubUrl=https%3A%2F%2Fwww.dailyfaceoff.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=17326&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=&appName=&appBundleId=https%3A%2F%2Fwww.dailyfaceoff.com%2F&appStoreUrl=&diaid=&appPrivacyPolicy=&appIsPaid=&appDeveloper=&appId=&appVersion=&sdkv=&enableResizeObserverInapp=0&isAppJs=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 55a4a6d06759abb4e7a6d1768597d7c40f333677b71f273280c9dc0a04d7197b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:24 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json; charset=utf-8
cache-control: no-store
access-control-allow-credentials: true
content-length: 14104
x-amz-cf-id: SOlJekByZi0Wg_sU6C90KaJr41cw2Kgj7WdIqsA6YWE78kybai4E_g==

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 3EF7 156 KB
14 KB 66ms
66ms XHR
application/json 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMSUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMTM2OCUlRaZcZGViXmYmZwYmMGJzZwAkZzQjNDx2NDMkMTAyMxZ2nWQ2NTNvMWFyMmNwYTZvNTU4MTMmMDE4Lz1jNCUmRaRinlUmRGV3o2qJQ0FaSW1Gp1c5STZJQ0cJVXcJMU5cSXNDnUFaSUNBnWRIoHqJnz9aSWgjWFZDSUgzUS5yq29aSUNBZ0ygoHcwrUx2SUNKUWNgoHRuWE1cTEFiZ0yDQWqJox4kWWyJNxyDSXZxWEJmYwJGn2N5OWcvnxV2ZG1fn1cXOHZxWE5fY25NqyxlOXVxoVZ5ZEqWn0k6TXuNryx0TDNnpFcHVaZYryy6WzcZrx1HSz1nnxF4Wz1Rq05EnmJORE14TVRBqzRgoGgOnyV6WWcGnFcUTXcZMxUlWWcVMU9ERXcNrxF4T0M1qGNEUWyMQW9aSUNBZ0ygNWynnUx2SURFMx9UZmBOREEjTURBp0NcQWqJQ0FcWyubq0ydo2qNVFx1T0RZME1En3yNQXA5Ly81pF9JSGUmX2RMpUqEREkapzRMTzysWauPYVJRWFE4S2gToVRPTGxjo0EzqzyxX2NioaRyoaRsnWQ9Mmp4MTt5MlZ2nWRsY29hqGVhqF9xZXNwPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X3RcqGkyPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X2R1pzF0nW9hPTEjMlZjoGFwZW1yoaRTqHJyYW1UrXByPTEzZGVvqWqJozZipz1uqGyiow0zpGkurWkcp3RJZD0kNDEjNvZ4PTQjMCZ5PTIlNSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMmMxQmMTMjMxQmMwM4NUYmMDMkN0Q3QwpmMmEmNmMlMmUmNTM1MmQmMDqEN0I0MmM1Mmp3RDqCNTM2NDMmNwQmMmRDNxQ1MwY4NwE1Nmp4MmU1QTZENDY2QTVBNTpmOTZENUE2OTM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwM0MmA3RDqCNTxmNDM0MmA3RDqCNwYmMTqEN0I0QmMkMmpmMmMlMmY3REZFRxUzYXBjTzFgZT0znXNBpHA9MCZupHBJZD0zZGyunWQ9JzFjpEJ1ozRfZUyxPWu0qHBmJTNBJTJGJTJGq3q3LzRunWk5ZzFwZW9zZv5wo20yMxYzYXBjU3RipzVVpzj9JzFjpFBlnXZuY3yQo2kcY3x9JzFjpEymUGFcZD0zYXBjVzVlp2yiow0zp2Reqw0zYXBjRGV2ZWkipGVlPSZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGMTE4LwAhNTx5Ml4kMTpeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZuqzFcoENuoXBunWqhpm0znXNBpHBKpm0jJzNmqXVcZD02NTNwMmNuY2I2ODt3JzNvqXN0ZXI9MTY5ODQ0NDIjNTU5MCZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032332D31302D32385F30317D7B7331373235353534307D7B4335377D7B53643364334C6D5268615778355A6D466A5A57396D5A69356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583634307D7B593434307D7B66317D7B4C31373332367DFEFE&userIpAddr=2001%3Aac8%3A20%3A3a00%3A1012%3Ad5e0%3Aa20f%3A6753&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F118.0.5993.117+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=22&c2pWaitTime=10&sdkv=&isSinglePageFloatSupport=1&availCampaigns=&isAmpIframe=0&tagKeywords=&cbuster=1698444204&csuuid=653c33acb6887&debugInfo=17255540_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=17255540&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed371ausxnwiyz&secondaryContent=&x=640&y=440&pubUrl=https%3A%2F%2Fwww.dailyfaceoff.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=17326&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=&appName=&appBundleId=https%3A%2F%2Fwww.dailyfaceoff.com%2F&appStoreUrl=&diaid=&appPrivacyPolicy=&appIsPaid=&appDeveloper=&appId=&appVersion=&sdkv=&enableResizeObserverInapp=0&isAppJs=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a5cfd91813dc1e977c25b2a04359f4752bdcb0d878097a003c3e9bf4db003093

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json; charset=utf-8
cache-control: no-store
access-control-allow-credentials: true
content-length: 14338
x-amz-cf-id: ZlYYHad9A45lALCLZqyzPbQPFt0fAv4mFMwyNKcPW2cTpYlw5jaWUA==

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 3EF7 56 KB
8 KB 66ms
66ms XHR
application/json 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMSUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMTM2OCUlRaZcZGViXmYmZwYmMGJzZwAkZzQjNDx2NDMkMTAyMxZ2nWQ2NTNvMWFyMmNwYTZvNTU4MTMmMDE4Lz1jNCUmRaRinlUmRGV3o2qJQ0FaSW1Gp1c5STZJQ0cJVXcJMU5cSXNDnUFaSUNBnWRIoHqJnz9aSWgjWFZDSUgzUS5yq29aSUNBZ0ygoHcwrUx2SUNKUWNgoHRuWE1cTEFiZ0yDQWqJox4kWWyJNxyDSXZxWEJmYwJGn2N5OWcvnxV2ZG1fn1cXOHZxWE5fY25NqyxlOXVxoVZ5ZEqWn0k6TXuNryx0TDNnpFcHVaZYryy6WzcZrx1HSz1nnxF4Wz1Rq05EnmJORE14TVRBqzRgoGgOnyV6WWcGnFcUTXcZMxUlWWcVMU9ERXcNrxF4T0M1qGNEUWyMQW9aSUNBZ0ygNWynnUx2SURFMx9UZmBOREEjTURBp0NcQWqJQ0FcWyubq0ydo2qNVFx1T0RZME1En3yNQXA5Ly81pF9JSGUmX2RMpUqEREkapzRMTzysWauPYVJRWFE4S2gToVRPTGxjo0EzqzyxX2NioaRyoaRsnWQ9Mmp4MTt5MlZ2nWRsY29hqGVhqF9xZXNwPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X3RcqGkyPVRbZSgGqXR1pzUeo2YeSz9hYXRbYW4eTWFlY2uyp3NuqWk0JaZcZF9wo250ZW50X2R1pzF0nW9hPTEjMlZjoGFwZW1yoaRTqHJyYW1UrXByPTMzZGVvqWqJozZipz1uqGyiow0zpGkurWkcp3RJZD0kNDEjNvZ4PTY1NvZ5PTM2OSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMmMxQmMTMjMxQmMwM4NUYmMDMkN0Q3QwpmMmEmNmMlMmUmNTM1MmQmMDqEN0I0MmM1Mmp3RDqCNTM2NDMmNwQmMmRDNxQ1MwY4NwE1Nmp4MmU1QTZENDY2QTVBNTpmOTZENUE2OTM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwM0MmA3RDqCNTxmNDM0MmA3RDqCNwYmMTqEN0I0QmMkMmpmMmMlMmY3REZFRxUzYXBjTzFgZT0znXNBpHA9MCZupHBJZD0zZGyunWQ9JzFjpEJ1ozRfZUyxPWu0qHBmJTNBJTJGJTJGq3q3LzRunWk5ZzFwZW9zZv5wo20yMxYzYXBjU3RipzVVpzj9JzFjpFBlnXZuY3yQo2kcY3x9JzFjpEymUGFcZD0zYXBjVzVlp2yiow0zp2Reqw0zYXBjRGV2ZWkipGVlPSZaZW9MYXRcPTUjLwEjNDxzZ2ViTG9hZm04LwYlOTUzqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGMTE4LwAhNTx5Ml4kMTpeU2FzYXJcJTJGNTM3LwM2JaBfYXyypxFjnUyxPSZuqzFcoENuoXBunWqhpm0znXNBpHBKpm0jJzNmqXVcZD02NTNwMmNuY2I2ODt3JzNvqXN0ZXI9MTY5ODQ0NDIjNTU5NvZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032332D31302D32385F30317D7B7331373235353534307D7B4335377D7B53643364334C6D5268615778355A6D466A5A57396D5A69356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583634307D7B593434307D7B66317D7B4C31373332367DFEFE&userIpAddr=2001%3Aac8%3A20%3A3a00%3A1012%3Ad5e0%3Aa20f%3A6753&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F118.0.5993.117+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=22&c2pWaitTime=10&sdkv=&isSinglePageFloatSupport=1&availCampaigns=&isAmpIframe=0&tagKeywords=&cbuster=1698444204&csuuid=653c33acb6887&debugInfo=17255540_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=17255540&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed371ausxnwiyz&secondaryContent=&x=640&y=440&pubUrl=https%3A%2F%2Fwww.dailyfaceoff.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1049&geoLong=8.6295&vpTemplate=17326&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=&subId=&appName=&appBundleId=https%3A%2F%2Fwww.dailyfaceoff.com%2F&appStoreUrl=&diaid=&appPrivacyPolicy=&appIsPaid=&appDeveloper=&appId=&appVersion=&sdkv=&enableResizeObserverInapp=0&isAppJs=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: bab3aaa8dcee55305b68434d9c09686160bc52fc2667b916b56cbf9e509ca1f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
x-cache: Miss from cloudfront
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json; charset=utf-8
cache-control: no-store
access-control-allow-credentials: true
content-length: 7779
x-amz-cf-id: LAd-V7_kVrfPaBUMwXKpkrcYPs3YSrkgJ5T5oPsZyZriDzPI9brJxQ==

GET
H2 200 logo_17326.png
video.primis.tech/uploads/video/users/logo/31368/ 19 KB
20 KB 120ms
29ms Image
image/png 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/video/users/logo/31368/logo_17326.png?cbuster=1677177910
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ae6c62a2a9c69aa427f3da2c542ce0a6572ec9a24d99c0cbcc27dcee10eeb09

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 12:12:29 GMT
via: 1.1 fa640a50340d741c579292b495a2218e.cloudfront.net (CloudFront), 1.1 f5db034a9eef3b097715a6b5d2c824a8.cloudfront.net (CloudFront)
x-amz-cf-pop: SFO5-P1, LHR50-P3
age: 35456
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 19841
last-modified: Thu, 23 Feb 2023 18:45:10 GMT
server: nginx
etag: "d009b6da409b751b4cee52bc57eefbcf"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: eJnbmT7785aUNNIDrDC_5UT3ZyY63jZrmZa1FYmqeQV1EyP3-za_xg==
expires: Sat, 28 Oct 2023 12:12:29 GMT

GET
H2 200 vid653b1ae33ca6b558133018_thumb.jpg
video.primis.tech/uploads/cn1/video/users/converted/31368/video_63f630bff01fd049643110/ Frame E44C 3 KB
4 KB 121ms
30ms Image
image/jpeg 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn1/video/users/converted/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018_thumb.jpg?cbuster=1698372448
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 216677b257b8aa0f42f6310e3b018a3cbfd423647c9f8ed0197f2afa584d6f18

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 05:15:46 GMT
via: 1.1 5fd5a7100537b482d912581a18b4587e.cloudfront.net (CloudFront), 1.1 f5db034a9eef3b097715a6b5d2c824a8.cloudfront.net (CloudFront)
x-amz-cf-pop: MCI50-P1, LHR50-P3
age: 60458
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 3421
last-modified: Fri, 27 Oct 2023 03:36:34 GMT
server: nginx
etag: "07fbca30ab75ddea1f36c0ee7ad779cf"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: l-BwZNl7Hi9ZQYnu2IHxMsgS6RjV_kR3C0j5R-uapSjLUIl_VnuRcQ==
expires: Sat, 28 Oct 2023 05:15:46 GMT

GET
H2 200 vid653b1a5bdc6bf607752377_thumb.jpg
video.primis.tech/uploads/cn1/video/users/converted/31368/video_63f630bff01fd049643110/ Frame E44C 3 KB
4 KB 120ms
29ms Image
image/jpeg 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn1/video/users/converted/31368/video_63f630bff01fd049643110/vid653b1a5bdc6bf607752377_thumb.jpg?cbuster=1698372323
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: c19af2b5bffd688812dfdfceb887898c4a8cb73ef566dda5777db4f22fb55440

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 05:15:46 GMT
via: 1.1 c9bef6d423a5d23e0ca5e2af8503331c.cloudfront.net (CloudFront), 1.1 f5db034a9eef3b097715a6b5d2c824a8.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1, LHR50-P3
age: 60458
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 3303
last-modified: Fri, 27 Oct 2023 03:21:59 GMT
server: nginx
etag: "8a0717340ca11d6c8e9e4f502ef393fb"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: JkbAJJQidUrQxj-ZFyhRpSJFAXnhF7tQfebYUM9U4uXdb49YV3G4hw==
expires: Sat, 28 Oct 2023 05:15:46 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
420 B 44ms
43ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTUjJaNypaZypyRcoWU9MTY5ODQ0NDIjNCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTEmNwp4JaN0YT0jJat9NwQjJax9NDQjJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzp2Reqw0zpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMmJEMmEmMDJEMmImODVGMmAmMTqEN0I3MmMkMmpmMwM1MmUmNTM0MmA3RDqCNDMmNTM3N0Q3QwUmNwQmMmY0MmM0QmZENTI2ODYkNTp3ODM1NUE2RDQ2NxE1QTU3Mmx2RDVBNwxmNTZBNwImMwMjM0Q3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmYmNDMjN0Q3QwU5MmQmNDMjN0Q3QwY2MmE3RDqCNEMmMTM3MmMmMwM2N0RGRUZFJzRcYWyxPSZ1p2VlSXBBZGRlPTIjMDEyM0FuYmtyM0ElMCUmQTNuMDAyM0EkMDElJTNBZDVyMCUmQWElMGYyM0E2NmUmJaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwEkOC4jLwU5OTMhMTE3JTIjU2FzYXJcJTJGNTM3LwM2JzNmqXVcZD02NTNwMmNuY2I2ODt3JzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMDU1NmAzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD0mMDM5NmpjODQ=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: yOQkIyr5CffalAmjdubRP9UdFXHR1EzywsW-sE5s_fVV725zUeE8NQ==

GET
H2 200 vid653b1ae33ca6b558133018.jpg
video.primis.tech/uploads/cn1/video/users/converted/31368/video_63f630bff01fd049643110/ 23 KB
23 KB 114ms
25ms Image
image/jpeg 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn1/video/users/converted/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.jpg?cbuster=1698372448
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 3b756d84fe739bb9f17ebc31396644e121e0765ac8449fb55a7522064d9fec27

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 05:15:40 GMT
via: 1.1 cd95edab6af9e155d29dc1b1149a5a70.cloudfront.net (CloudFront), 1.1 f5db034a9eef3b097715a6b5d2c824a8.cloudfront.net (CloudFront)
x-amz-cf-pop: DFW53-C1, LHR50-P3
age: 60465
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 23473
last-modified: Fri, 27 Oct 2023 03:36:32 GMT
server: nginx
etag: "aeb05983c20eac035ea2a7d7acfe26b3"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: IWMa3eayJXynfKyccUbA_1bwKlIbOPnfMMQGmrATW9POo3ZOsWtd-g==
expires: Sat, 28 Oct 2023 05:15:40 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
313 B 127ms
126ms XHR
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=753031
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d09ddd3e6a62c7e77c9c17a99a9f3136d6da9ff926129f3cd5f93030bc80a36

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fr3c7G6xrCdKThT4EWSNHb9pVAUmBKuSp4AD42JKyASJpq0T%2FPQN8r%2BdR8EG%2FY4Ups0EataY7qFBeC58RS%2FzVS5sUw%2BK6BcxnoHUOFkGrtneelokghe%2BL1AXjWOudBHGqcNrNYk1"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 81ce3a9d4ad0bbd4-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 204 prebid Show response
krk2.kargo.com/api/v1/ 0
502 B 21ms
20ms XHR
text/plain 3.126.229.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk2.kargo.com/api/v1/prebid
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.229.145 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-229-145.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
x-accel-expires: 0
accept-ch: Sec-CH-UA,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
nbr: 508
vary: Accept-Encoding
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
krk-no-bid-reason: consent
expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
61 B 29ms
28ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:24 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 388 B
422 B 267ms
266ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=14194&site_id=405436&zone_id=2272616&size_id=2&rf=https%3A%2F%2Fwww.dailyfaceoff.com%2F&tg_i.domain=dailyfaceoff.com&tg_i.page=https%3A%2F%2Fwww.dailyfaceoff.com%2F&tg_i.pbadslot=%2F63317524%2Fdfo%2Farticles%2Fleaderboard_header--pb-slot-header&tk_flint=pbjs_lite_v7.54.3&x_source.tid=2437b072-071c-4476-a138-dad1b5dbc82a&l_pb_bid_id=43c994263e8e275&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=2437b072-071c-4476-a138-dad1b5dbc82a&rp_maxbids=1&slots=1&rand=0.4561851747032968
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 75d0e1101dc27c87c6956c676035c917c751ed157df687c3d409f3f1377246f8

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 388
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 hb-mm-multi Show response
hb.minutemedia-prebid.com/ 105 B
456 B 80ms
77ms XHR
application/json 54.171.212.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.171.212.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-212-190.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 7bdbd49fc2840a0bedc3cfd93eee56befb12b4ae64c76dc0b649e8d8030810d6

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json
access-control-allow-credentials: true
x-envoy-upstream-service-time: 11
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
562 B 96ms
95ms XHR
application/json 185.86.138.122
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
154 B 152ms
151ms XHR
text/plain 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:25 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 135
server: envoy
vary: origin, Accept-Encoding

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 50 B
729 B 16ms
15ms XHR
application/json 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-35-156-243-142.eu-central-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

b98d68dfcac900dd387f517a3e8e5d84bc1c3b775222660221c780a73d729fb7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
an-x-request-uuid: 08722701-0123-41c6-b865-8ee77cbb182c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 50
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
138 B 20ms
19ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 9c8e933852d168773d7d40514f550910e7731858c101e2d0654fcad6c105dd83

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
546 B 30ms
3ms XHR
application/json 35.156.243.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.54.3&referrer=https%3A%2F%2Fwww.dailyfaceoff.com%2F&tmax=2500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.156.243.142 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
accept-ch: sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness
x-auction-status: 29
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
433 B 61ms
36ms XHR
application/json 54.171.212.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.171.212.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-212-190.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 24fbec8c97a011616f14985e3ae0546618dbd22685d2edd0bd68f60abb2a27f1

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 84

POST
H2 200 / Show response
shb.richaudience.com/hb/ 4 B
239 B 43ms
21ms XHR
text/html 157.90.3.144
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://shb.richaudience.com/hb/
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 157.90.3.144 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.144.3.90.157.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: d6dffe998d4d52601dd56a1666bbd09f6926bc110429c434402ca7a814080808

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
server: nginx/1.14.2
vary: Accept-Encoding, Accept-Encoding
access-control-max-age: 86400
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true

POST
H2 200 prebid Show response
mp.4dex.io/ 60 B
139 B 52ms
31ms XHR
application/json 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77b47b7a038f38916adbe760bc262fe2aa75e9f2a0d67621d19ad74e41acdb39

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
x-err: Shapings: no adunits with size and seat and mapping
x-version: 3.0.0-gcp-ams
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
content-encoding: gzip
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 81ce3a9da94f37da-FRA
expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
966 B 193ms
177ms XHR
application/json 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

876702a557e79418c29be6c55093cbd7e42f5195486183a54e69937862c2f037

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
an-x-request-uuid: f3b65fd3-2aeb-4684-88ee-ee3a710649ba
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
198 B 37ms
20ms XHR
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=7.54.3&cb=26236731240&lsavail=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:25 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
161 B 59ms
45ms XHR
text/plain 3.126.163.234
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.163.234 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-163-234.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:25 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 15 KB
7 KB 150ms
146ms XHR
application/json 216.52.2.30
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.54.3
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 New York, United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: 4bfd16961ed1b30e30101c7daa373b554902b425ffabeceaab8ff67aba419233

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 27 Oct 2023 22:03:25 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.dailyfaceoff.com
Transfer-Encoding: chunked
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 200 hb-mm-multi Show response
hb.minutemedia-prebid.com/ 105 B
455 B 35ms
35ms XHR
application/json 54.171.212.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.minutemedia-prebid.com/hb-mm-multi
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.171.212.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-212-190.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 03798fac6a1ae0c8e7d89a6c656f7c16ac00098c6616065517669d090ea35ab0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 105

POST
H2 204 prebid Show response
krk2.kargo.com/api/v1/ 0
502 B 17ms
16ms XHR
text/plain 3.126.229.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk2.kargo.com/api/v1/prebid
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.229.145 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-229-145.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
x-accel-expires: 0
accept-ch: Sec-CH-UA,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
nbr: 508
vary: Accept-Encoding
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
access-control-allow-credentials: true
krk-no-bid-reason: consent
expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
161 B 108ms
107ms XHR
text/plain 3.126.163.234
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.163.234 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-163-234.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:25 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
198 B 26ms
26ms XHR
text/plain 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=7.54.3&cb=97313000302&lsavail=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:25 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H3 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
94 B 28ms
27ms XHR
text/plain 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 840ef5f125c6bbffe74cc756fab25709b5a6ce539803e1b9b2410c8386557ff2

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 google
vary: Origin
content-type: text/plain
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 145 B
967 B 179ms
178ms XHR
application/json 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

a54790c816cd58bfc91796efed376b5f0554a52a74d48202af3ef2e919c6e12d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
an-x-request-uuid: 7597d6f1-8641-46d5-9b7c-fabd8db5cfe3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 / Show response
shb.richaudience.com/hb/ 4 B
239 B 19ms
19ms XHR
text/html 157.90.3.144
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://shb.richaudience.com/hb/
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 157.90.3.144 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.144.3.90.157.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: d6dffe998d4d52601dd56a1666bbd09f6926bc110429c434402ca7a814080808

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
server: nginx/1.14.2
vary: Accept-Encoding, Accept-Encoding
access-control-max-age: 86400
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 14 KB
6 KB 183ms
182ms XHR
application/json 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-35-156-243-142.eu-central-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

206ec692f682e7210dc8e768e2233b0fdbb31413124e35f116764bde81eeb329

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
an-x-request-uuid: 34ef4a42-2438-48c5-a850-986e3672a063
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 5 KB
3 KB 141ms
108ms XHR
application/json 216.52.2.30
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.54.3
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 New York, United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: cdc0b6480fa0cad16fdc99115734b4b76cb8bbe59c7b4d1c71cf75943623e1c5

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 27 Oct 2023 22:03:25 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.dailyfaceoff.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 2498

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
530 B 255ms
254ms XHR
application/json 35.156.243.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=7.54.3&referrer=https%3A%2F%2Fwww.dailyfaceoff.com%2F&tmax=2500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.156.243.142 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
accept-ch: sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 prebid Show response
mp.4dex.io/ 60 B
139 B 34ms
29ms XHR
application/json 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77b47b7a038f38916adbe760bc262fe2aa75e9f2a0d67621d19ad74e41acdb39

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
x-err: Shapings: no adunits with size and seat and mapping
x-version: 3.0.0-gcp-ams
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
content-encoding: gzip
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 81ce3a9dd96737da-FRA
expires: 0

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
521 B 119ms
117ms XHR
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=923190
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a72cb0a9f83cb4dec370c4a53fcb46aa12eb35cb7ce405672bafc38bfcae913

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LR9fBbL3pv%2FRzqweRUAQ3KaZdyHx0v4ag0oJlVr8DUWpxDHWU7Wt9NTIwgTd0VCilE9qaYtNf1cmMDCUj6fVsF9HmGAzCli6ZsTAbD8WCs5i2FQBUKhz0khIQIkbnbUTa9yWHR11"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 81ce3a9ddead904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 388 B
422 B 99ms
98ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=14194&site_id=405436&zone_id=2272738&size_id=15&rf=https%3A%2F%2Fwww.dailyfaceoff.com%2F&tg_i.domain=dailyfaceoff.com&tg_i.page=https%3A%2F%2Fwww.dailyfaceoff.com%2F&tg_i.pbadslot=%2F63317524%2Fdfo%2Farticles%2Fboxbanner_right2--pb-slot-right-2&tk_flint=pbjs_lite_v7.54.3&x_source.tid=bb84f6b4-2495-4c7f-984f-6f95d1b8fdfe&l_pb_bid_id=9650193e95f50cb&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=bb84f6b4-2495-4c7f-984f-6f95d1b8fdfe&rp_maxbids=1&slots=1&rand=0.3282174106572686
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f286a73d4d1d68bb440ae8d6733c6e97e355860130286ad2db1cedb4c837a0f9

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 388
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 21 KB
3 KB 156ms
155ms XHR
application/json 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 4e93609719fd02ee4384c0230d3ce4fcafe153ce351d73812cd45bf752c3004e

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:24 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 139
content-length: 3390

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
432 B 41ms
37ms XHR
application/json 54.171.212.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.171.212.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-212-190.eu-west-1.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: dc5d9ca995a55caa58caf374359e64572afddf0cc6cd6109fc063389ed35b1bb

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:25 GMT
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.dailyfaceoff.com
content-type: application/json
access-control-allow-credentials: true
x-envoy-upstream-service-time: 6
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
content-length: 83

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
61 B 36ms
36ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:24 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
567 B 99ms
84ms XHR
application/json 185.86.138.122
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: edge.aditude.io
URL: https://edge.aditude.io/prebid/7.54.3.js?modules=WyJhZGFnaW9CaWRBZGFwdGVyIiwiYW14QmlkQWRhcHRlciIsImFwcG5leHVzQmlkQWRhcHRlciIsImNvbnNlbnRNYW5hZ2VtZW50IiwiY29uc2VudE1hbmFnZW1lbnRVc3AiLCJjcml0ZW9CaWRBZGFwdGVyIiwiZW5yaWNobWVudEZwZE1vZHVsZSIsImZhYnJpY2tJZFN5c3RlbSIsImdkcHJFbmZvcmNlbWVudCIsImdwdFByZUF1Y3Rpb24iLCJpZDVJZFN5c3RlbSIsIml4QmlkQWRhcHRlciIsImthcmdvQmlkQWRhcHRlciIsIm1lZGlhZnVzZUJpZEFkYXB0ZXIiLCJtaW51dGVtZWRpYUJpZEFkYXB0ZXIiLCJvcGVueEJpZEFkYXB0ZXIiLCJwcmljZUZsb29ycyIsInB1Ym1hdGljQmlkQWRhcHRlciIsInJpY2hhdWRpZW5jZUJpZEFkYXB0ZXIiLCJyaXNlQmlkQWRhcHRlciIsInJ1Ymljb25CaWRBZGFwdGVyIiwic2NoYWluIiwic2hhcmV0aHJvdWdoQmlkQWRhcHRlciIsInNtYXJ0YWRzZXJ2ZXJCaWRBZGFwdGVyIiwic292cm5CaWRBZGFwdGVyIiwidHJpcGxlbGlmdEJpZEFkYXB0ZXIiLCJ1bmlmaWVkSWRTeXN0ZW0iLCJ2YWxpZGF0aW9uRnBkTW9kdWxlIl0%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.dailyfaceoff.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 23:02:07 GMT
x-content-type-options: nosniff
age: 342078
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 22 Oct 2024 23:02:07 GMT

POST
H2 200 web-vitals
www.dailyfaceoff.com/_axiom/ 0
126 B 152ms
149ms Ping
text/plain 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_axiom/web-vitals

Requested by

Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/_next/static/chunks/pages/_app-cf9cf791326c77a6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
strict-transport-security: max-age=63072000
cf-cache-status: DYNAMIC
x-vercel-id: fra1::wd5tv-1698444205927-2152d2f1dcb9
server: cloudflare
x-vercel-cache: MISS
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 81ce3a9ee8d05bf1-FRA
content-length: 0

GET
H2 204 g_pbst
1x1.a-mo.net/hbx/ 0
89 B 313ms
99ms Image
text/plain 54.92.137.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1x1.a-mo.net/hbx/g_pbst?A=amx&w=300&h=250&bid=109e14e4e71b76c3&c1=banner&np=0.018414000000000003&aud=30c2e14185bd2d8&a=/63317524/dfo/articles/boxbanner_right--pb-slot-right-1&c2=hb_bidder%3Damx%26hb_adid%3D109e14e4e71b76c3%26hb_pb%3D0.01%26hb_size%3D300x250%26hb_source%3Dclient%26hb_format%3Dbanner%26hb_adomain%3Dfirmen.tv&ts=1698444205938&eid=114c25f73a993fb4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.92.137.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-92-137-241.compute-1.amazonaws.com
Software: MonetEngine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
cache-control: max-age=0, private, must-revalidate
server: MonetEngine

GET
H2 200 vid653b1ae33ca6b558133018.jpg
video.primis.tech/uploads/cn1/video/users/converted/31368/video_63f630bff01fd049643110/ 23 KB
23 KB 26ms
25ms Image
image/jpeg 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://video.primis.tech/uploads/cn1/video/users/converted/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.jpg?cbuster=1698372448
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 3b756d84fe739bb9f17ebc31396644e121e0765ac8449fb55a7522064d9fec27

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 05:15:40 GMT
via: 1.1 cd95edab6af9e155d29dc1b1149a5a70.cloudfront.net (CloudFront), 1.1 f5db034a9eef3b097715a6b5d2c824a8.cloudfront.net (CloudFront)
x-amz-cf-pop: DFW53-C1, LHR50-P3
age: 60465
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 23473
last-modified: Fri, 27 Oct 2023 03:36:32 GMT
server: nginx
etag: "aeb05983c20eac035ea2a7d7acfe26b3"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: iYiUBxe0W39TKk9UvGxtOBXyF_XJ1ytUe8zNF4mfJueBEOyobml8vA==
expires: Sat, 28 Oct 2023 05:15:40 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame E44C 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.dailyfaceoff.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Mon, 23 Oct 2023 23:02:07 GMT
x-content-type-options: nosniff
age: 342078
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 22 Oct 2024 23:02:07 GMT

GET
H2 200 48ce1010-d9fb-4e4a-9180-d1a0eb720b79 Show response
config.aps.amazon-adsystem.com/configs/ 537 B
815 B 69ms
15ms Script
application/javascript 108.139.243.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/48ce1010-d9fb-4e4a-9180-d1a0eb720b79
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.243.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-243-64.mxp63.r.cloudfront.net
Software: CloudFront /
Resource Hash: 460f1244842bc6da64dfe2d9a5db61ef9198d54e94b649dea6be76715e7d968c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 21:20:51 GMT
via: 1.1 caeb89b8b8a5b107795bac07edc9b810.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: MXP63-P3
age: 2555
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 537
x-amz-cf-id: Mw_ZteCfXDFeYZ9QZ5PXoYz6RnZZNqMIqkz1VX4AOJAkRoD3xa1elQ==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 2 KB
2 KB 16ms
15ms XHR
application/json 13.224.89.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.dailyfaceoff.com&pubid=48ce1010-d9fb-4e4a-9180-d1a0eb720b79
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.89.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-83.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: 9650c2f047b36768b976528d0a79622dd201ffb17c6bdb499f7de288a3e1e9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 17:47:31 GMT
via: 1.1 110750d14d1d900cd5c76d0ac872f5dc.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ZRH50-C1
age: 15354
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1703
x-amz-cf-id: 5TTacfJo8nUiIZ_mOBk7ElB6plmraYPwNbYn7SGs2QD_v-AhfoKJ3Q==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
466 B 96ms
50ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.dailyfaceoff.com%2F&pid=NDvtMSklCjMsy&cb=0&ws=1600x1200&v=23.1020.1619&t=2500&slots=%5B%7B%22sd%22%3A%22pb-slot-right-1_fcxqoxpg9zm%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F63317524%2Fdfo%2Farticles%2Fboxbanner_right%22%7D%5D&pubid=48ce1010-d9fb-4e4a-9180-d1a0eb720b79&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: 9VFFMHE74A0C94YGKRQF
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: gVtbSCEzMS5Mu7M_TYLDuNFKyda9-d0g9tyCDZLg80wHCV1y69xZiQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
465 B 88ms
51ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.dailyfaceoff.com%2F&pid=NDvtMSklCjMsy&cb=1&ws=1600x1200&v=23.1020.1619&t=2500&slots=%5B%7B%22sd%22%3A%22pb-slot-header_qulnvmzb3sc%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F63317524%2Fdfo%2Farticles%2Fleaderboard_header%22%7D%5D&pubid=48ce1010-d9fb-4e4a-9180-d1a0eb720b79&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: SQH9X48YWXD9CHQV48YJ
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: CY9LPD46Vc68Sjj791QjISUchr3HER8dpEliw8zSG07V76mVUGLFjg==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
466 B 76ms
49ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.dailyfaceoff.com%2F&pid=NDvtMSklCjMsy&cb=2&ws=1600x1200&v=23.1020.1619&t=2500&slots=%5B%7B%22sd%22%3A%22pb-slot-right-2_wf4e99cztx%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F63317524%2Fdfo%2Farticles%2Fboxbanner_right2%22%7D%5D&pubid=48ce1010-d9fb-4e4a-9180-d1a0eb720b79&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: K8FNNW6BWHEEBDTWM99G
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: mhKQxhk88AOXwIJScrI6M6HXTyK9KAkLj0JG50OmE82eFnp0okj1lQ==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 48ms
16ms XHR
application/javascript 13.224.89.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.89.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-83.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 a63182cf51dce7998774e112bf9ee7c6.cloudfront.net (CloudFront)
date: Fri, 27 Oct 2023 02:20:27 GMT
x-amz-cf-pop: ZRH50-C1
age: 72087
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: 7ha6L-DfIy9fyqoRh4-VrQO6lUl1ZOMhsascis8QzrvMThaMIfoKag==

POST
H/1.1 200
OK auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 3EF7 184 B
475 B 91ms
10ms XHR
application/json 69.173.144.137
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.144.137 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 1c9e093dff3dccca5949b2ec7d95ce0fde4a030d56f866c05f97c34ef6fd54c1

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
content-encoding: gzip
x-prebid: pbs-java/2.1.0
Content-Type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
Cache-Control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 172
Expires: 0

POST
H2 200 / Show response
shb.richaudience.com/hb/ Frame 3EF7 4 B
239 B 24ms
24ms XHR
text/html 157.90.3.144
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://shb.richaudience.com/hb/
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 157.90.3.144 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.144.3.90.157.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: d6dffe998d4d52601dd56a1666bbd09f6926bc110429c434402ca7a814080808

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: gzip
server: nginx/1.14.2
vary: Accept-Encoding, Accept-Encoding
access-control-max-age: 86400
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame 3EF7 144 B
994 B 158ms
158ms XHR
application/json 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

01dae0ec506162147fb3866741d9abbd1d30fe98893260cf8579a64d0b0467c8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:26 GMT
an-x-request-uuid: 7e24f85c-ecd4-456a-84e9-f6ca70b67906
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 144
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame 3EF7 36 B
491 B 87ms
87ms XHR
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=491831&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%227c4e1a1f13b1e6%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.dailyfaceoff.com%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A2%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A2%2C%22ren%22%3Afalse%2C%22version%22%3A%227.16.0%22%2C%22userIds%22%3A%5B%22pubProvidedId%22%5D%2C%22url%22%3A%22https%3A%2F%2Fwww.dailyfaceoff.com%2F%22%2C%22tmax%22%3A3000%2C%22syncsPerBidder%22%3A5%2C%22pbadslot%22%3A%22%2FPRM%2F113678%2Fwww_dailyfaceoff_com%22%2C%22adunitcode%22%3A%22adUnit_17%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2289f5438115cf54%22%2C%22ext%22%3A%7B%22siteID%22%3A%22491831%22%2C%22tid%22%3A%22f89baf68-8161-451f-a4cc-3f02148c5834%22%2C%22sid%22%3A%22656x369%22%2C%22fl%22%3A%22x%22%2C%22gpid%22%3A%22%2FPRM%2F113678%2Fwww_dailyfaceoff_com%22%7D%2C%22video%22%3A%7B%22playerSize%22%3A%5B%5B656%2C369%5D%5D%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22placement%22%3A3%2C%22plcmt%22%3A2%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22playbackmethod%22%3A%5B6%5D%2C%22w%22%3A656%2C%22h%22%3A369%7D%2C%22bidfloor%22%3A0.7%2C%22bidfloorcur%22%3A%22USD%22%7D%2C%7B%22id%22%3A%229b07d01d7916b9%22%2C%22ext%22%3A%7B%22siteID%22%3A%221014833%22%2C%22tid%22%3A%2261808b31-e2b7-4569-810d-0c3267b66967%22%2C%22sid%22%3A%22656x369%22%2C%22fl%22%3A%22x%22%2C%22gpid%22%3A%22%2FPRM%2F113678%2Fwww_dailyfaceoff_com%22%7D%2C%22video%22%3A%7B%22playerSize%22%3A%5B%5B656%2C369%5D%5D%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22placement%22%3A3%2C%22plcmt%22%3A2%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22playbackmethod%22%3A%5B6%5D%2C%22w%22%3A656%2C%22h%22%3A369%7D%2C%22bidfloor%22%3A0.7%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22primis.tech%22%2C%22sid%22%3A%2231368%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22114a0e8a-47ec-4838-98cd-d83c33a69030%22%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%7D
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9c4716596e995d114d45a22e4adfc14eb492e37edfd12be58c2cfd122bc992f

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PSW8V50OBTB2aoNLvf%2FCFsXAzWqi1DiMKQ%2FJe8E1RwGuRjQ6lV1qmi2sxhWj707CG2C6l8RnQ%2Fjo5hl7naWzwJZVOBuTEXTh6aswaYRFMepEtiRF7u%2FP5yQSNP8t%2Bi%2FbYxWuhysn"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 81ce3aa0f8db904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 36
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 3EF7 0
61 B 18ms
18ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:26 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 3EF7 0
61 B 31ms
31ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:26 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 liveInternalSsp.php Show response
rtb.primis.tech/live/ Frame 3EF7 25 B
494 B 299ms
293ms XHR
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.primis.tech/live/liveInternalSsp.php?sspData=%7B%22enc%22%3Atrue%2C%22comp%22%3Atrue%2C%22data%22%3A%22%5C%22rJmgWrgP47tW%2F2hQ5a5byEsm%2BgwC7Vk2tEXDpPzIHMqgPnRk1aYb8NsPvrPETtwMjwJnqbVUcn3PI%2Bs5O45mEC8PsP%2BWpLtrBIi297XauM1%2F%2FkChO1bhnq6S3XYcdk8rrtzyALO6yAMrSWVBTxwZLadhXg63%2F%2F3h%2F1oTI%2FptPgIfNJq6OQbwmUobZdgiEERchltduMzkNt2hYrKGpW%2B3ba67e4wkDAzyQcFinU7YrQE8O1JKjkr0ZFe1YzCeB78QTcTuDQ8C8khaiIYyD0amD%2FahhwE5DxGFifzGfM6%2BkeJzCRXVFizsCri1H%2F2358%2FJLpVE9fobZXxaw0YUkSkhJFN2gyauoC%2BfROIgZmiFefuM9JQeWhoA25NA%2F%2B%2BGhu9RW6NOWU6KafsS%2Ba%2FCBWU6m3D1XAqlO5RFZo1GWNopMz%2FEpjw6m1Be75Brt1OLDSScJ52lB1bU6MBsup293E%2B9Q%2B7ZN7tbEjKbSkpI0om9rRsN%2FjNsv6bdlBXJiyDQgjdD2AztkgkPX%2F737sRE3qAg6A2Y4X4z%2BIY1Ibp6xCiPSkmXCqM0pDjP8hyrbDXv1NKwTS6QMTZ0Hp%2BqQ8y2NCgWvRP5dWx1VFXTIQCCVrs9MuXtmnDetHFZy3yug8VWlxdbali47Pq7J0r0hIrEELZrO5wgFMXp6xIlTv75RLnBrM7cLpL356lt%2BH7nUaGOOfAYxnCKSpGddSdtn8wa48XoCT1S6zI1Tb%2BLfGszZE24XXYiv0nFNvYqLkPq5JW%2Bd2pWDyxc7Ed2UayFmcEQa3fchJb%2BjewS4qE%2BNjgPKfiZDyETwGyLNr%2BrZIJK42TDLMuN01ADPxEjgO%2FQIpIhWM2kET4%2BNknmnzRlXVgVEYUBDtKEfluJDGZaBpM3S47KiIOwfJxh3kHPKSbk6SjK9nttq%2FIS0OHYZysmSAmgdhbM09kusGNQuT4SffmmiDylSYJz85wt2TjJxyzn4HlWJ8efKHUDxkkxYNyecuuY117o%2BpzuGkZFjsZxOEVmxgWo43LN%2BA7JlrJgEgM1fhpFUZmbddlmtbcg47trWxDUNIG3JirPuegaYTPEEdCjS73OnQxjPI4LEtBkXSQ53VHuSILVvNZzzfBcSmRyd9HJCbihlb3g8OdeMQegKxQ3ZWrDMvBK56zKSeptOpI39dwTUvgO%2FwuE1UFjBG6G%2FtdhUUrDWAVHWyOxNts%2BIyrLXuAH89t1Y7ivJKP5zRDVpZzTh0HWLMx%2BdGP5aKAOPNiCEy9yqgQinx28XZfCqvBqECRHcD56MegdlI%2FyLF%2Fo%2FVPeex26tMYpNAothEGuUuJrbzJZ3kN%2BOQXvBOJvwlvIx9uTvoqOSpmzChVgW%2BcqTDdPYpvcBfqTZzqIxFXBzE6b6%2Bv9EeS3HpYKpVynWW9eQusU7pUWqswUFedd9C5z2ZMrdQyBAFm6Thhfbiy6jvtdVtlj5otUxuOx4CuYeFEu4Oo%2FzAo8lr5Xx%2FHOIcyYJz70Rh2bNY3nMsnDFBD21r04ya837nwq%2FYXghOnE7LrEFIPZPWkHL4zvefT%2FXDid0sKTqiSC%2BqP9CEeM9ivBysYGNsAShMRWjhiMmzsd%2BWe7%2FIcr1x%2BK41oWDa20ptKkV88ss72VW02PWwzMQgqf8F7rlxP599PKeoh%2FfJV5aVHMlbdm7jTLZ%2FeZw6NYJ%2FgNk6f6f3yzice9DfLd%2FMpKKwlDWkgxrk%2FoEIPUg%2BB5uAojxO1GmQmhuR%2FIgRUj37ckpmRQ2xFeW8c6sBNvm7tRPyyqBf2r6Ol3124OqG9%2FoA6rQcQjCMDng0CUVgMwRIapMDWm5OWIMcR%2FP4wShihBKK9AyBCOYg2a9kqhGMEk3DOIbte270IUspT9ExSRiP43AIb2YtcQyAbNKPPbeQBFnZbAyCQkFsAnQLHy3kGtKHq%2FInCAfiLhORjJ53N4Jaw7B39Tpf%2FDCCamvbFsT3om4EEwDFN4tkQN4%2F2STh58%2FrwxpSq38yUargvXtmeuPV4fzkpd5zR3rcPR6owPAAJ2RG5Z50C4wHeZTTVI1%2Be866y6rqMrbDYH99s2psv1XpAyhdUoBC9ATyC5dr3T%2F%2FZVZi9WjNSmpWDzD3lAWSiB1QaOpGZC3slsdWpjFrpsGqsTzQ%3D%3D%5C%22%22%7D
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 1d16d42e33c80a00df5f4c6a514edbfaa985a2cdf0d33b4f76f90a6625b773b7

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:25 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
access-control-allow-credentials: true
x-amz-cf-id: TqXV5gr97EK2PwvUNbH98i-V0JnsIn1E_XPaLbYjZMFEBEpV6tcyQQ==

GET
H2 200 48ce1010-d9fb-4e4a-9180-d1a0eb720b79 Show response
config.aps.amazon-adsystem.com/configs/ Frame 3EF7 537 B
813 B 16ms
15ms Script
application/javascript 108.139.243.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/48ce1010-d9fb-4e4a-9180-d1a0eb720b79
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.243.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-243-64.mxp63.r.cloudfront.net
Software: CloudFront /
Resource Hash: 460f1244842bc6da64dfe2d9a5db61ef9198d54e94b649dea6be76715e7d968c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 21:20:51 GMT
via: 1.1 caeb89b8b8a5b107795bac07edc9b810.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: MXP63-P3
age: 2555
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 537
x-amz-cf-id: PGmFvN3yc-yKXwFrFNfUxU6nEAPZGYv_dDierCJ9L6JsQuAcgAA1pQ==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ Frame 3EF7 2 KB
2 KB 15ms
14ms XHR
application/json 13.224.89.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.dailyfaceoff.com&pubid=48ce1010-d9fb-4e4a-9180-d1a0eb720b79
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.89.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-83.zrh50.r.cloudfront.net
Software: Server /
Resource Hash: 9650c2f047b36768b976528d0a79622dd201ffb17c6bdb499f7de288a3e1e9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 17:47:31 GMT
via: 1.1 110750d14d1d900cd5c76d0ac872f5dc.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ZRH50-C1
age: 15354
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1703
x-amz-cf-id: se1JmLRB76aK8pkBHUls9t3Qzb8mFQew_FWcDnrvbGczazyMKmK9cQ==

GET
H2 200 %7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%2248ce1010-d9fb-4e4a-9180-d1a0eb720b79%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrar... Show response
aax.amazon-adsystem.com/x/px/p/PH/ Frame 3EF7 43 B
417 B 54ms
39ms Fetch
image/gif 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/x/px/p/PH/%7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%2248ce1010-d9fb-4e4a-9180-d1a0eb720b79%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrary%252FdidError%22%2C%22feat%22%3A%22started%22%7D%5D%2C%22u%22%3A%22https%253A%252F%252Fwww.dailyfaceoff.com%252F%22%2C%22lv%22%3A%2223.1020.1619%22%7D

Requested by

Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 75a13c74495137fb5435dc4030981df6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: JTN2W08WQGES2VE5N2N3
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: no-cache
content-length: 43
x-amz-cf-id: V1QCk6D6EDF0zpHBwzGJGPpjFLHGjQwfBE2wj00E2-rAaCjkWtTRww==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ Frame 3EF7 23 B
465 B 53ms
52ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.dailyfaceoff.com%2F&pid=raZFHmvMiGgbJ&cb=0&ws=1x1&v=23.1020.1619&t=2000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A80%2C%22id%22%3A%22Amazon_Video_400x225_Mob%22%2C%22mt%22%3A%22v%22%7D%5D&pubid=48ce1010-d9fb-4e4a-9180-d1a0eb720b79&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 8eee0c5143f92bd7600d25e3dc25ce5e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: NF8BG8B6T8EV700MP7YZ
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: CFOquRdI7jTgl_L2h5IaBXo1c8b4K5MHZGmrpl6_TNsCqFJGFibFaw==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 3EF7 6 KB
3 KB 14ms
13ms XHR
application/javascript 13.224.89.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.89.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-83.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 a63182cf51dce7998774e112bf9ee7c6.cloudfront.net (CloudFront)
date: Fri, 27 Oct 2023 02:20:27 GMT
x-amz-cf-pop: ZRH50-C1
age: 72087
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: ff_5zadWoZC_yMHOwYB5gUdGGoVczzL4mFvhY58tWll0cJinqrTaTw==

GET
H2 200 script.js Show response
cadmus.script.ac/dahhc4ozyvjm6/ 132 KB
46 KB 33ms
33ms Script
application/javascript 2606:4700::6812:1791
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cadmus.script.ac/dahhc4ozyvjm6/script.js
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1791 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05bf9f66804f5b3fd3709c98ce41ebe1a4a9ce41383afb559282b5d035360960

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: gzip
last-modified: Fri, 27 Oct 2023 16:39:42 GMT
server: cloudflare
age: 0
etag: W/"df69c18a6b7ca223bebd3a6b46665609cb2af612"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=600,stale-while-revalidate=3600,stale-if-error=86400
cf-ray: 81ce3aa18bae5c14-FRA

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ 75 KB
24 KB 33ms
18ms Fetch
application/javascript 2606:4700:20::681a:9a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: caf2558c473f0989ccb9e45da327c56bb9f877da13fe442adc10644d75e2f1d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Fri, 27 Oct 2023 22:03:26 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 391476
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 23 Oct 2023 08:11:06 GMT
Server: cloudflare
ETag: W/"42783f4dfb63346ef86cbdd3594314a1"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bbmX1JZS5YxM49T1q3E2pJqgmCMgGGWP0vRGI5uau7elT8XpMwCpyWOSVrd1NoQXuNmiDlfqvMQ8CrH%2F55WnT4JnCZcCRZ%2FSdQtnaydlDWJ2sRC3fBEgH63O9c5zXT%2BjSW%2FKfwO%2FCY%2FSnxYn"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 81ce3aa1988e3a7e-FRA

OPTIONS
H2 200 recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 0
0 303ms
96ms Preflight 3.226.11.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.11.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-11-122.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.dailyfaceoff.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Fri, 27 Oct 2023 22:03:26 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 launchpad-liveramp.js Show response
launchpad-wrapper.privacymanager.io/e259636c-e529-4ade-add0-0481c90e58bf/ 2 KB
2 KB 91ms
21ms Script
text/javascript 54.192.137.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad-wrapper.privacymanager.io/e259636c-e529-4ade-add0-0481c90e58bf/launchpad-liveramp.js
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.137.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-137-23.lhr62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b4ca989cec583ed69b2df63c05d91ead25e13201945d9cc0bf9238a1a4d96045

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 02:20:28 GMT
x-amz-version-id: h91SDFhOPIWZi6JuY3Jh6k._VuWPgtEM
content-encoding: gzip
via: 1.1 ce084a1179392e1921b98c60a4590284.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C5
age: 70979
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-disposition: attachment; filename="launchpad-liveramp.js"
last-modified: Fri, 25 Aug 2023 19:36:12 GMT
server: AmazonS3
etag: W/"a45252f007dde799051d352790bae43f"
vary: Accept-Encoding
content-type: text/javascript
x-amz-cf-id: OdffXtOfpOQRS5uKdPOgfMJrMVl6GhkDSKNYI6sf7-TT_PP6dMBMEg==

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 207ms
13ms Script
application/javascript 2.23.78.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.23.78.67 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-78-67.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Fri, 27 Oct 2023 22:18:26 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 39 KB
12 KB 92ms
24ms Script
text/javascript 18.165.201.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.201.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-201-38.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7713183ba1a38b1ea2be2d5f7d3d49dab7b8d468cf78a603e6517ffbd1f33d59

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 01:34:59 GMT
content-encoding: gzip
via: 1.1 d1187be634e389e2e876be936bba8e74.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:42 GMT
server: AmazonS3
x-amz-cf-pop: LHR50-P3
age: 73708
x-amz-server-side-encryption: AES256
etag: W/"6e8b1f94eaf615b7d0953ad4e8d8bb85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: zcAzv2B9cUS9uXx5PiXxsY6x7ay0jMC5KamsENN5qW9YcPKFjMNfjQ==

POST
H2 200 recordVendorsLoaded Show response
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 0
128 B 97ms
96ms XHR
text/plain 3.226.11.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.11.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-11-122.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Fri, 27 Oct 2023 22:03:26 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 722 B
753 B 248ms
247ms Fetch
text/plain 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2420201654124190&correlator=4097638976352861&eid=31079110%2C31079233&output=ldjh&gdfp_req=1&vrg=202310180103&ptt=17&impl=fif&iu_parts=63317524%2Cdfo%2Chome%2Cboxbanner_right&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=1&didk=3417701857&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1698444206397&lmt=1698437006&adxs=743&adys=421&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Fwww.dailyfaceoff.com%2F&vis=1&psz=388x0&msz=388x0&fws=0&ohw=0&ga_vid=137208439.1698444205&ga_sid=1698444206&ga_hid=1222580907&ga_fc=true&dlt=1698444204146&idt=1779&prev_scp=test%3Dprebid%26cw%3Ddailyfaceoff.com%26amznbid%3D2%26amznp%3D2&adks=1321903318&frm=20

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8b61de031c9ca1a2595e7f6e33626130f32d5f2cb64ff2075cb75f4159aa2be1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 356
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 98ms
61ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202310180103&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310180103/pubads_impl.js?cb=31079110

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c73e71693ae2d6b47e3af52357f5709628e1ab6f1a3e68546546b89423a0575f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12180
x-xss-protection: 0

GET
H2 200 container.html Show response
259f49d43f9ce59c9f2afc839769d37e.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D44F 6 KB
3 KB 92ms
15ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://259f49d43f9ce59c9f2afc839769d37e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 22:03:26 GMT
expires: Sat, 26 Oct 2024 22:03:26 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 638 B
312 B 235ms
234ms Fetch
text/plain 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2420201654124190&correlator=1613312898141984&eid=31079110%2C31079233&output=ldjh&gdfp_req=1&vrg=202310180103&ptt=17&impl=fif&iu_parts=63317524%2Cdfo%2Chome%2Cleaderboard_header&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90&ifi=2&didk=4013707231&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1698444206456&lmt=1698437006&adxs=436&adys=1449&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Fwww.dailyfaceoff.com%2F&vis=1&psz=1280x0&msz=1280x0&fws=0&ohw=0&ga_vid=137208439.1698444205&ga_sid=1698444206&ga_hid=1222580907&ga_fc=true&dlt=1698444204146&idt=1779&prev_scp=test%3Dprebid%26cw%3Ddailyfaceoff.com%26amznbid%3D2%26amznp%3D2%26hb_format_sovrn%3Dbanner%26hb_size_sovrn%3D728x90%26hb_pb_sovrn%3D0.00%26hb_adid_sovrn%3D11597effbb12cf59%26hb_bidder_sovrn%3Dsovrn%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.00%26hb_adid%3D11597effbb12cf59%26hb_bidder%3Dsovrn&adks=3487462529&frm=20

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8da870fddc73389a65817e544819ad05fa8a7f595a93f657ab151f271d3380a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 29 KB
12 KB 219ms
218ms Fetch
text/plain 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2420201654124190&correlator=1527281366833309&eid=31079110%2C31079233&output=ldjh&gdfp_req=1&vrg=202310180103&ptt=17&impl=fif&iu_parts=63317524%2Cdfo%2Chome%2Cboxbanner_right2&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=3&didk=63984967&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1698444206478&lmt=1698437006&adxs=1124&adys=1591&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Fwww.dailyfaceoff.com%2F&vis=1&psz=300x250&msz=300x0&fws=512&ohw=0&ga_vid=137208439.1698444205&ga_sid=1698444206&ga_hid=1222580907&ga_fc=true&dlt=1698444204146&idt=1779&prev_scp=test%3Dprebid%26cw%3Ddailyfaceoff.com%26amznbid%3D2%26amznp%3D2%26hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D300x250%26hb_pb_appnexus%3D0.12%26hb_adid_appnexus%3D12202608782a2169%26hb_bidder_appnexus%3Dappnexus%26hb_format_amx%3Dbanner%26hb_size_amx%3D300x250%26hb_pb_amx%3D0.01%26hb_adid_amx%3D1172275e9fc0f094%26hb_bidder_amx%3Damx%26hb_format_sovrn%3Dbanner%26hb_size_sovrn%3D300x250%26hb_pb_sovrn%3D0.03%26hb_adid_sovrn%3D1164b9df8c119af1%26hb_bidder_sovrn%3Dsovrn%26hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.12%26hb_adid%3D12202608782a2169%26hb_bidder%3Dappnexus&adks=1106154392&frm=20

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b274b46ff98a2800b10fc6bfd1022c3ad0b5bbd3eedbbca44c6db1ff8849f69d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12362
x-xss-protection: 0
google-lineitem-id: 6302246149
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138432896372
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 launchpad-liveramp.js Show response
launchpad-wrapper.privacymanager.io/e259636c-e529-4ade-add0-0481c90e58bf/ Frame 3EF7 2 KB
2 KB 22ms
21ms Script
text/javascript 54.192.137.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad-wrapper.privacymanager.io/e259636c-e529-4ade-add0-0481c90e58bf/launchpad-liveramp.js
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.137.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-137-23.lhr62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b4ca989cec583ed69b2df63c05d91ead25e13201945d9cc0bf9238a1a4d96045

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 02:20:28 GMT
x-amz-version-id: h91SDFhOPIWZi6JuY3Jh6k._VuWPgtEM
content-encoding: gzip
via: 1.1 ce084a1179392e1921b98c60a4590284.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C5
age: 70979
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-disposition: attachment; filename="launchpad-liveramp.js"
last-modified: Fri, 25 Aug 2023 19:36:12 GMT
server: AmazonS3
etag: W/"a45252f007dde799051d352790bae43f"
vary: Accept-Encoding
content-type: text/javascript
x-amz-cf-id: 28DLlsG4pt1xTKoXj1qWgKsGgllpSFdS1QHOWw2zaYuaPR4I2432PQ==

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ Frame 3EF7 54 KB
17 KB 55ms
25ms Script
application/javascript 2.23.78.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.23.78.67 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-78-67.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Fri, 27 Oct 2023 22:18:26 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ Frame 3EF7 39 KB
12 KB 25ms
24ms Script
text/javascript 18.165.201.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.201.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-201-38.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7713183ba1a38b1ea2be2d5f7d3d49dab7b8d468cf78a603e6517ffbd1f33d59

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 01:34:59 GMT
content-encoding: gzip
via: 1.1 d1187be634e389e2e876be936bba8e74.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:42 GMT
server: AmazonS3
x-amz-cf-pop: LHR50-P3
age: 73708
x-amz-server-side-encryption: AES256
etag: W/"6e8b1f94eaf615b7d0953ad4e8d8bb85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: lk-_dWWsHr7nSexK-RPg4yPs7ou_6k5BAX9cGhL10hD7a93WTzDHEg==

GET
H2 200 launchpad.bundle.js Show response
launchpad.privacymanager.io/latest/ 128 KB
26 KB 98ms
25ms Script
application/x-javascript 108.156.46.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.46.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-46-25.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 53fcbdb394dab3494945cd64fbd897b641057715860ee624ec0d3c5e701edac2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-amz-version-id: PnaJdxHydHN9eEuWHl7A1SeLMo27G9Y2
content-encoding: br
via: 1.1 2baf05c1608b7148404c7fdd295985ea.cloudfront.net (CloudFront)
date: Fri, 27 Oct 2023 21:56:14 GMT
last-modified: Fri, 27 Oct 2023 11:56:06 GMT
server: AmazonS3
x-amz-cf-pop: LHR50-P2
age: 433
x-amz-server-side-encryption: AES256
etag: W/"8f65165dbe6028fe7739c568043840fc"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: must-revalidate,public,max-age=3600
x-amz-cf-id: MAIZds6C-y6zjnkZdi5VUKnCaWYER5cLGNuglF8_FS00PHOOzVuOIQ==

OPTIONS
H3 204 1a
i.clean.gg/ Frame 0
0 96ms
95ms Preflight
text/plain 34.95.69.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.dailyfaceoff.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=utf-8
date: Fri, 27 Oct 2023 22:03:26 GMT
server: nginx/1.21.6
via: 1.1 google

POST
H3 200 1a Show response
i.clean.gg/ 0
15 B 101ms
100ms XHR
application/octet-stream 34.95.69.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dahhc4ozyvjm6/script.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
via: 1.1 google
server: nginx/1.21.6
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 100ms
60ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 27 Oct 2023 22:03:26 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 3EF7 362 KB
125 KB 39ms
14ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08111d73cf694f4b8b7339301e9bb8f18326ff8e5bead87bbd8d7a9ead6e74c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127417
x-xss-protection: 0
expires: Fri, 27 Oct 2023 22:03:26 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 43 B
473 B 21ms
20ms Image
image/gif 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTYzp2VlqzVlVGygZT0kNwx4NDQ0MwA1JaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTplNTYmMTIzrD02NTYzrT0mNwxzoXN0YT0kNmI1NTU0MCZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzqzyxX2F0nT12nWRyolZ1p2VlSXBBZGRlPTIjMDEyM0FuYmtyM0ElMCUmQTNuMDAyM0EkMDElJTNBZDVyMCUmQWElMGYyM0E2NmUmJaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwEkOC4jLwU5OTMhMTE3JTIjU2FzYXJcJTJGNTM3LwM2JzNmqXVcZD02NTNwMmNuY2I2ODt3JaJ2ow01NDQjJzF0qGVgpHRNqWk0nXBfnWVlPTIjJzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJaBfYWNyoWVhqFN0pzVuoVR5pGU9MSZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0jJzNwpGE9MCZwY3BuQ29hp2VhqD0zY2J1p3Rypw0kNwx4NDQ0MwA2NwA5JaVcZD1TZWgcozRiU1BfYXyypwY1M2MmM2FwZDYmMGQzpHVvVXJfPWu0qHBmJTNBJTJGJTJGq3q3LzRunWk5ZzFwZW9zZv5wo20yMxYzZzkiYXRTqGF0qXM9ZzFfp2UzZWyxp3A9pHJyYzyxJaB4nWQ9MwIjNwA0NDQ4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:26 GMT
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
x-amz-cf-id: k5InYu-E5gecOTkLEq9wYfz9ik8XoEKfXFTGbehFCDwSDGVW2VufSg==
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
338 B 120ms
30ms XHR
application/json 52.210.247.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.247.62 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-247-62.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: e0cb3a2656b642eec435dd8e72bb737734fc69af03edd834bb34493df614197b

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:26 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache
x-server: 10.45.21.33
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 launchpad.bundle.js Show response
launchpad.privacymanager.io/latest/ Frame 3EF7 128 KB
26 KB 26ms
25ms Script
application/x-javascript 108.156.46.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://launchpad.privacymanager.io/latest/launchpad.bundle.js
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.46.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-46-25.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 53fcbdb394dab3494945cd64fbd897b641057715860ee624ec0d3c5e701edac2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-amz-version-id: PnaJdxHydHN9eEuWHl7A1SeLMo27G9Y2
content-encoding: br
via: 1.1 2baf05c1608b7148404c7fdd295985ea.cloudfront.net (CloudFront)
date: Fri, 27 Oct 2023 21:56:14 GMT
last-modified: Fri, 27 Oct 2023 11:56:06 GMT
server: AmazonS3
x-amz-cf-pop: LHR50-P2
age: 433
x-amz-server-side-encryption: AES256
etag: W/"8f65165dbe6028fe7739c568043840fc"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: must-revalidate,public,max-age=3600
x-amz-cf-id: faWvdywtq4DUk3tRhv6vYK93GmrRatJYTVs4lL1lABXD9bpRnODD4A==

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ Frame 3EF7 60 B
338 B 69ms
31ms XHR
application/json 52.210.247.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.247.62 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-247-62.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: e0cb3a2656b642eec435dd8e72bb737734fc69af03edd834bb34493df614197b

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:26 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache
x-server: 10.45.12.242
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 / Show response
geo.privacymanager.io/ 30 B
607 B 28ms
27ms Fetch
application/json 108.139.243.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.243.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-243-72.mxp63.r.cloudfront.net
Software: /
Resource Hash: e257df7266563e157bb7df93fd09c6d13afb1c9554468b21c7378e09a94d3250

Request headers

Accept: application/json
Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 27 Oct 2023 00:59:45 GMT
via: 1.1 122731c1a09cfba14dfeeff504946134.cloudfront.net (CloudFront), 1.1 71f808ad45a98980e167f452a2aaf882.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3, MXP63-P3
age: 75821
x-amzn-requestid: 75ae87d7-8138-402c-9787-31fb3634fce2
x-amzn-trace-id: Root=1-653b0b81-4a5b299e41e3670549563f50;Sampled=0;lineage=06620786:0
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-apigw-id: Nb68TEa_DoEEW1g=
content-length: 30
x-amz-cf-id: AU7FVYcB7cYCx5qtt5MO-rO8-xIHuGE2TyIFPSy5Zv4Vo_br4_X18Q==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

OPTIONS
H2 200 /
geo.privacymanager.io/ Frame 0
0 179ms
125ms Preflight
application/json 108.139.243.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.243.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-243-72.mxp63.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.dailyfaceoff.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Fri, 27 Oct 2023 22:03:26 GMT
via: 1.1 98e5b56b1ba8a3ddf54b22d6fc81c3c2.cloudfront.net (CloudFront), 1.1 71f808ad45a98980e167f452a2aaf882.cloudfront.net (CloudFront)
x-amz-apigw-id: Ne0DXFv6DoEEm0w=
x-amz-cf-id: eNs2lXQLnq3PV1QTIlq0zlCAl9NxuGQJkUVnZdu-MXvZ5VbzRaOYOg==
x-amz-cf-pop: MXP53-P1 MXP63-P3
x-amzn-requestid: bff34f2d-5bd0-48f7-ae3b-48edc9462ec8
x-cache: Miss from cloudfront

GET
H2 200 / Show response
geo.privacymanager.io/ Frame 3EF7 30 B
607 B 24ms
18ms Fetch
application/json 108.139.243.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.243.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-243-72.mxp63.r.cloudfront.net
Software: /
Resource Hash: e257df7266563e157bb7df93fd09c6d13afb1c9554468b21c7378e09a94d3250

Request headers

Accept: application/json
Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 27 Oct 2023 00:59:45 GMT
via: 1.1 122731c1a09cfba14dfeeff504946134.cloudfront.net (CloudFront), 1.1 71f808ad45a98980e167f452a2aaf882.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3, MXP63-P3
age: 75821
x-amzn-requestid: 75ae87d7-8138-402c-9787-31fb3634fce2
x-amzn-trace-id: Root=1-653b0b81-4a5b299e41e3670549563f50;Sampled=0;lineage=06620786:0
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-apigw-id: Nb68TEa_DoEEW1g=
content-length: 30
x-amz-cf-id: nvi1X5KvzutFJxWy3zA_9uieg1AhfHENjltV-hYtDQvyR5kGTqZkYw==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

OPTIONS
H2 200 /
geo.privacymanager.io/ Frame 0
0 95ms
56ms Preflight
application/json 108.139.243.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.243.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-243-72.mxp63.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.dailyfaceoff.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: *
content-length: 0
content-type: application/json
date: Fri, 27 Oct 2023 22:03:26 GMT
via: 1.1 159e16027561f2440d64c3f79534611e.cloudfront.net (CloudFront), 1.1 71f808ad45a98980e167f452a2aaf882.cloudfront.net (CloudFront)
x-amz-apigw-id: Ne0DWHAoDoEEaMQ=
x-amz-cf-id: ZwfkBxbuePitsUtgryAnmGTKADO_BbKUITSGC-vzyws3MuJUc6vIGA==
x-amz-cf-pop: MXP53-P1 MXP63-P3
x-amzn-requestid: cd182328-d0d8-4690-a543-f2dd313e7495
x-cache: Miss from cloudfront

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame AD59 13 KB
5 KB 9ms
7ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 42711
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 10:11:35 GMT
expires: Sat, 26 Oct 2024 10:11:35 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 1691 829 B
1 KB 43ms
18ms Document
text/html 2a00:1450:4001:802::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

aae141a10815da23307e21f87d55c9b0a80de1600dddd83e0164b8c9b03a202b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_T6Y38gr0w7BfSG8Am_mFA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-_T6Y38gr0w7BfSG8Am_mFA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 22:03:26 GMT
expires: Fri, 27 Oct 2023 22:03:26 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E465 0
0 51ms
50ms Fetch
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssvrsOEboDW5T5t5tuZ8EtGLdY-Z377sKbHCyc1GEsZBnoaJHQx0P7TS6IdOl3dnikSkJm63b12_zcrjyjCRyOYhVjNtMwf5AN4XhKxRawTcmUcHQIdTQcN-hKVod1YmB1eBhjafeyOmhDxmD5v3N1DsMeeE2OAuJNrz-cg6ReYWmJhphS9uogI0GvwfWQop6dcV85QfmGKkkSafRdYqOQXQZGSGb6j5WNKc3Pnrv0GtGe36esQ1s_kepD7O2FtkSyC-3PODais8W29FWrY9wcApQojkeNfG9hNQz9mK1KaaqgjQGRhrEGpSvuNS3gk7ieLqNOGeSqCDVRGQzMi_lyqPIuLpNJ9GfsUN6p_JSSIhvGPL22j0pTmytRg8yE4mg&sai=AMfl-YQd5-E3MX9bhtWD5pmW09AiGUHzsUyXw_WQzWc0k8UBlnIHgl5ALYfPvVkClED9mm_LWCIj6iFSWG0lPLqb3HyPqRm9fJxWW5SyGPAWBYxIkGRR2o8w7-t4IadO-3g77UWxp6yod4_k32XSo4E&sig=Cg0ArKJSzIjRQU5fY37MEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 27 Oct 2023 22:03:26 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame E465 26 KB
10 KB 44ms
16ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f85637bbf5c0ee6a01fa5afb711af0e3d873ab20f0cbeaeb9105998530822c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5738
x-jsd-version: 1.16.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230064-FRA, cache-jnb7024-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"6721-FSYTlyriJmmnEqYsq5KQLDRsrFg"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=quj9llZT1rzzx5v7iLZQwP63OU6yikptgDr1KfYw2xcn731fqBIX1gN33BvUAX6PXqPGOMvBg6X3TbN9x8th%2FMjhJH9n8QHjAOLJLaInuQhuSgrj2y58lhIxup6Wj8rOMCukCiA3Ab496DkMbrI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 81ce3aa489c01c32-FRA

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E465 187 KB
59 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e155284926ba010442d774fd493ff925a0256bd427f54596b1244791a3fa170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60190
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698233972131352"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 27 Oct 2023 22:03:26 GMT

GET
H2 200 bridge3.599.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 5ECD 753 KB
242 KB 8ms
6ms Document
text/html 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

889ce7128a1460ca45b5e8b4e22c950f46e1ba71f62b22c05e6553588be964dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 132573
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 247375
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 09:13:53 GMT
expires: Fri, 25 Oct 2024 09:13:53 GMT
last-modified: Thu, 26 Oct 2023 09:08:13 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 3EF7 44 KB
17 KB 54ms
20ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 27 Oct 2023 22:03:26 GMT

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame DBDE 40 KB
14 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6300f448d738e70ac11f0140df0b3ce91a2de9e0da7fdf09d32d28031600ba51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 21:58:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 326
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13893
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 15:57:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 27 Oct 2023 22:58:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame D4EF 52 KB
17 KB 89ms
23ms Document
text/html 23.211.9.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7838&pub_id=997666
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.211.9.60 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-9-60.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 27 Oct 2023 22:03:27 GMT
ETag: "623de86a-cf34"
Expires: Sat, 28 Oct 2023 22:03:29 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
X-Akamai-EW-Subworker: 8096267

GET
H2 200 rd_log Show response
ams3-ib.adnxs.com/ Frame E465 0
646 B 48ms
14ms Script
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams3-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.dailyfaceoff.com%2F&e=wqT_3QLbDvTwAlsHAAADANYABQEIrefwqQYQ5Ljczpfr4PxlGOKyr52G4L6Bcyo2Cf8i-Bfx3Mc_Eb7GR-6IyL4_GQAAAEAzMwNAIdtws9Nqo8Q_KeW4UzpY_88_MQAAAEAK19M_MJ2Q1A04nj1Ah11IAlCtpPjbAViY301gAGjo1mZ40PEFgAEBigEDVVNEkgEDVVNEmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDY5MDM4ODYsIDApO3VmKCdpJywgNzg2MzY4OCwgMCk7dWYoJ2cnLCAxOTgyNzk5MiwgMCk7dWYoJ3MnLCAyODc2Nzg2NjksIDApO3VmKCdyJywgNDYxMjQ3MDIxLCAwKTuSAvkFIXFKYjBzZ2pzekpJYUVLMmstTnNCR0FBZ21OOU5NQUE0QUVBQVNJZGRVSjJRMUExWUFHQ2lBMmdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCZG81Yy1UZFZ6al9CQWMtcUk4MC1fODhfeVFFQUFBQUFBQUR3UDlrQjJldmRILTlWN2pfZ0FZajczd1AxQVFBQUlFQ1lBZ0NnQWdHMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQW9MYTFDdm9BbzItN3FrRy1BSUFnQU1CbUFNQm9nTVhDTzJ5MkN3UUFoZ0JMUUFBQUFBeUIyUmxabUYxYkhTaUF3NElndHJVS3hBSUdBQXRZQ0hDUGFJRERnaUMydFFyRUFrWUFDMWdJY0k5b2dNT0NJVGExQ3NRQ2hnQUxRQUFnRC1pQXc0STVkUzZLaEFMR0FJdEFBQUFBTG9EQ1VGTlV6TTZOakF4TWVBRDZrU0FCUGJZNXd1SUJQM1k1d3VRQkFHWUJBR3lCQWtJbXBCTEVNdmZ2dzI2QkJrSWhRUVJ3X1VvWElfQ3hUOFpBQUFBQUFBQUFBQWdtcEJMdWdRYUNLNWFFUUFBQQUXDEFBR1ENCWBDeEFJTXJVanhEQkJNUDFLRnlQd3NVX3lRESEkQXNRTmdFQVBFRQ0yUEFBQUNJQmZzdW1BWE53WmFKQWFrRgEWAQEQOEQteEIVOxBBQXdRVQEXAQEIRVFNLigABF9SLigAADINKMhMRVM0UC1BRnBzTUI4QVdZbXJvSi1BWE9zS1VEZ2dZRFJWVlNpQVlBa0FZQm1BWUFvUVkBXAEBLEVRS2dHQkxJR0pBawEQCQEAQh23BEJrCRQBAQBDHRgYTGdHQ29FSQEXBEFEQZCYOC6aApkBIWp4cVhsd2pzekpJYUVLMmstTnNCR0pqZlRTQUFLQUF4BTEEQUEBZHg2Q1VGTlV6TTZOakF4TVVEcVJFblo2OTBmNzFYdVAxHW0ARh2FMEdIRDlTaGNqOExGUDIVGAhzUUgdMBBIZ0FpUREQ8FhEd1B3Li7YAryUA-ACsLJe6gIdaHR0cHM6Ly93d3cuZGFpbHlmYWNlb2ZmLmNvbS_yAhEKBkFEVl9JRBIHNjkwMzg4NvICEgoGQ1BHX0lEEggxOTgyNzk5MgEVVAVDUF9JRBIJMjg3Njc4NjY58gINCggBPhhGUkVREgEwBRAcUkVNX1VTRVIFEAAMCSAYQ09ERRIA8gEPCENQRxUPEAsKB0NQFQ4UEAoFSU9fAYkINzg2gacY8gILCgdJTxUhOBsKD0NVU1RPTV9NT0RFTAErNAg5MTU2NTMxNPICGgoWMh4AHExFQUZfTkFNBXkIKAoaNh0ACEFTVAFGaElGSUVEEgoxNjk4NDA2MTU38gIVCghTUExJVAFfGevwsIADAIgDAZADAJgDF6ADAaoDAMAD2ATIAwDYA9b9I-ADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA00NS4xNDEuMTUyLjc3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDzExOTExI0FNUzM6NjAxMdoEAggB4AQB8AStpPjbAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAUMeAAA2AUB4AUB8AXxvwT6BQQIABAAkAYAmAYAuAYAwQYJJCzwP9AG6pEB2gYWChAJEhkBdBAAGADgBgHyBgIIAIAHAYgHAKAHAcgH0PEF0gcNCREoASYI2gcGAV6oGADgBwDqBwIIAPAH0uADiggCEACVCAAAgD-YCAHACLyUA9IIBggAEAAYAA..&s=2e1bde53e7100c198c77aa5294d9bfd55ef8bb53&bdref=https%3A%2F%2Fwww.dailyfaceoff.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.dailyfaceoff.com%2F,https%3A%2F%2Fwww.dailyfaceoff.com%2F&

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
an-x-request-uuid: ea7cdbae-5d42-49c9-8d94-201b40ca6a36
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK 5d8dc6b5-349c-4113-b7e3-4f565a86f5d9.jpg
crcdn01.adnxs-simple.com/creative/p/11911/2023/8/30/49640577/ Frame E465 37 KB
37 KB 127ms
27ms Image
image/jpeg 23.211.9.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crcdn01.adnxs-simple.com/creative/p/11911/2023/8/30/49640577/5d8dc6b5-349c-4113-b7e3-4f565a86f5d9.jpg
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.211.9.60 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-9-60.deploy.static.akamaitechnologies.com
Software: nginx/1.21.3 /
Resource Hash: ac1b23dbeb99bac0e5940f3609753e6f8a821a4d10e269e4002a3b3254b267ac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Fri, 27 Oct 2023 22:03:27 GMT
Last-Modified: Wed, 30 Aug 2023 15:28:53 GMT
Server: nginx/1.21.3
x-amz-request-id: e3216106-2ae1-45b6-a2e2-1cabb0a0a6d9
ETag: "00906b9ff71e0f647516f774714b36db"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
X-Clv-Request-Id: e3216106-2ae1-45b6-a2e2-1cabb0a0a6d9
Cache-Control: max-age=3888000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 37599
X-Clv-S3-Version: 2.5
Expires: Mon, 11 Dec 2023 22:03:27 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/239/ Frame E465 80 KB
27 KB 98ms
19ms Script
application/x-javascript 23.211.9.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/239/trk.js
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.211.9.60 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-9-60.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a9c49f9f526c232731b2ff9aa3e31b686b8b339bdd246bbf74f804c802f9755d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Fri, 27 Oct 2023 22:03:27 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jul 2023 11:56:12 GMT
Server: AkamaiNetStorage
ETag: "615fd4ad24a409f4de5416b603f042c1:1689076572.555276"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27646
Expires: Sat, 26 Oct 2024 22:03:27 GMT

GET
H2 200 it
ams3-ib.adnxs.com/ Frame E465 0
646 B 152ms
120ms Image
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams3-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.dailyfaceoff.com%252F&e=wqT_3QK6DPTwAjoGAAADANYABQEIrefwqQYQ5Ljczpfr4PxlGOKyr52G4L6Bcyo2Cf8i-Bfx3Mc_Eb7GR-6IyL4_GQAAAEAzMwNAIdtws9Nqo8Q_KeW4UzpY_88_MQAAAEAK19M_MJ2Q1A04nj1Ah11IAlCtpPjbAViY301gAGjo1mZ40PEFgAEBigEDVVNEkgEDVVNEmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDY5MDM4ODYsIDApO3VmKCdpJywgNzg2MzY4OCwgMCk7dWYoJ2cnLCAxOTgyNzk5MiwgMCk7dWYoJ3MnLCAyODc2Nzg2NjksIDApO3VmKCdyJywgNDYxMjQ3MDIxLCAwKTuSAvkFIXFKYjBzZ2pzekpJYUVLMmstTnNCR0FBZ21OOU5NQUE0QUVBQVNJZGRVSjJRMUExWUFHQ2lBMmdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCZG81Yy1UZFZ6al9CQWMtcUk4MC1fODhfeVFFQUFBQUFBQUR3UDlrQjJldmRILTlWN2pfZ0FZajczd1AxQVFBQUlFQ1lBZ0NnQWdHMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQW9MYTFDdm9BbzItN3FrRy1BSUFnQU1CbUFNQm9nTVhDTzJ5MkN3UUFoZ0JMUUFBQUFBeUIyUmxabUYxYkhTaUF3NElndHJVS3hBSUdBQXRZQ0hDUGFJRERnaUMydFFyRUFrWUFDMWdJY0k5b2dNT0NJVGExQ3NRQ2hnQUxRQUFnRC1pQXc0STVkUzZLaEFMR0FJdEFBQUFBTG9EQ1VGTlV6TTZOakF4TWVBRDZrU0FCUGJZNXd1SUJQM1k1d3VRQkFHWUJBR3lCQWtJbXBCTEVNdmZ2dzI2QkJrSWhRUVJ3X1VvWElfQ3hUOFpBQUFBQUFBQUFBQWdtcEJMdWdRYUNLNWFFUUFBQQUXDEFBR1ENCWBDeEFJTXJVanhEQkJNUDFLRnlQd3NVX3lRESEkQXNRTmdFQVBFRQ0yUEFBQUNJQmZzdW1BWE53WmFKQWFrRgEWAQEQOEQteEIVOxBBQXdRVQEXAQEIRVFNLigABF9SLigAADINKMhMRVM0UC1BRnBzTUI4QVdZbXJvSi1BWE9zS1VEZ2dZRFJWVlNpQVlBa0FZQm1BWUFvUVkBXAEBLEVRS2dHQkxJR0pBawEQCQEAQh23BEJrCRQBAQBDHRgYTGdHQ29FSQEXBEFEQZCYOC6aApkBIWp4cVhsd2pzekpJYUVLMmstTnNCR0pqZlRTQUFLQUF4BTEEQUEBZHg2Q1VGTlV6TTZOakF4TVVEcVJFblo2OTBmNzFYdVAxHW0ARh2FMEdIRDlTaGNqOExGUDIVGAhzUUgdMBBIZ0FpUREQ9BcBRHdQdy4u2AK8lAPgArCyXuoCHWh0dHBzOi8vd3d3LmRhaWx5ZmFjZW9mZi5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAPYBMgDANgD1v0j4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDTQ1LjE0MS4xNTIuNzeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQPMTE5MTEjQU1TMzo2MDEx2gQCCAHgBAHwBK2k-NsBiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAF8b8E-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBuqRAdoGFgoQAAUSGQFwEAAYAOAGAfIGAggAgAcBiAcAoAcByAfQ8QXSBw0VZQEmCNoHBgFeyBgA4AcA6gcCCADwB9LgA4oIAhAAlQgAAIA_mAgBwAi8lAPSCA4IgYKEiJCgwIABEAAYAA..&s=41ce0d6313bb3ac6d66d9448741fd2e99baecb3a

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
an-x-request-uuid: bbfcc109-478f-4f56-9c82-5fbd847e8c9b
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 ingest.php
events.newsroom.bi/ 2 B
780 B 21ms
19ms Ping
application/json 162.19.56.86
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=294
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.19.56.86 , France, ASN16276 (OVH, FR),
Reverse DNS: haproxy01.cl13.ovh.mrf.io
Software: istio-envoy /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
server: istio-envoy
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 2

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 1691 0
0 42ms
41ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202310180103&jk=2420201654124190&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E465 0
0 63ms
44ms Fetch
image/gif 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss2dxkx5wy2BHw-j3lP6pZQNEgP4pljQGlcpiKBG5MPMr1Oy2kW_2pweoMOTuh_c7Y-MMgtjFkIaIdDyYMN-wRA4VVyI6-JRwWft-5UzZYgM9nOF0A6IckOYrSCpqREZfcY6ehIfRTa6y-Ra9BDtkTZM0XaMQiqNVerX8a9n3x4XBHTRE4uDr--DLOpzaQ1Hso8RFIDTO2_qQFmjga4m35raK5PbhI3dz-pLup7amFj40WetbGdq-p5R2Lxyx0abjAlorRdIsKGHnkzpOq7GqU8iCz8h5mQQeIVlpqVjFRWXV9ucC3nsgPrCr4x7V26JSQLiaF5LhEEG77Z8-kJ-7WuF3URrHx1US4nU8rG_ShumRKRlPG1fKfucyXr6xEbZGCk&sai=AMfl-YRR30fzQLIiQYFmQTtZAYajSe6PZfiMlBfCUWF7au-LAXaj5XXaDvj-IgKgjKa6Go04OrWI4pENgCcpaaUkk_xIHhUzcHgdHKhS6S2iQkTsS4gO47Fn77Rr0N4GNE5ZyPlzvofQ_Dg6d8cyXAc&sig=Cg0ArKJSzHPV6LcJ83IjEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 27 Oct 2023 22:03:27 GMT

GET
DATA 200
OK truncated
/ Frame E465 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4a244bba173746bb344d9da5e64977d078c97b29b2656e5e189ed6809f02db4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame D4EF 0
595 B 20ms
19ms Script
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7838&pub_id=997666&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7838&pub_id=997666

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
an-x-request-uuid: 1394f90c-d48b-4ae2-b4a9-3b952221f9e8
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js Show response
pagead2.googlesyndication.com/bg/ Frame AD59 38 KB
15 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99235240097ffe1c3ccf93f0275840df66a62f6ce406788402b06df413755d67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 11:45:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37065
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15010
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 26 Oct 2024 11:45:42 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 5ECD 156 B
143 B 293ms
293ms XHR
text/xml 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F63317524%2Fdfo%2Fhome%2Fvideo&description_url=https%3A%2F%2Fwww.dailyfaceoff.com%2F&env=vp&correlator=1143668415600860&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=670x338&unviewed_position_start=1&ad_rule=0&cust_params=player%3Dprimis%26tagID%3D%26postID%3D%26prmsig%3Dwdvsfe&sdkv=h.3.599.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&sdki=445&ptt=20&adk=4099075284&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.599.0&sid=67FBD55A-AE9C-4E55-B9FC-550D0D930F7D&nel=0&eid=44772139%2C44777649%2C44781409%2C44802463%2C44806075&ref=https%3A%2F%2Fwww.dailyfaceoff.com%2F&url=https%3A%2F%2Fwww.dailyfaceoff.com%2F&dt=1698444207343&cookie=ID%3D308d2f0f8c1e4dbc%3AT%3D1698444206%3ART%3D1698444206%3AS%3DALNI_MYu3bQ2peP66yA41sAPxUM9Lh0Dug&gpic=UID%3D00000caa4952bf1e%3AT%3D1698444206%3ART%3D1698444206%3AS%3DALNI_MaODL0aDXhX8rpDJAd_zD98WePjbQ&scor=3745081227201634&ged=ve4_td2_tt0_pd2_la2000_er581.-2600.734.-2300_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 vevent
ams3-ib.adnxs.com/ Frame E465 0
666 B 30ms
30ms Ping
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams3-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.dailyfaceoff.com%2F&e=wqT_3QK6DPTwAjoGAAADANYABQEIrefwqQYQ5Ljczpfr4PxlGOKyr52G4L6Bcyo2Cf8i-Bfx3Mc_Eb7GR-6IyL4_GQAAAEAzMwNAIdtws9Nqo8Q_KeW4UzpY_88_MQAAAEAK19M_MJ2Q1A04nj1Ah11IAlCtpPjbAViY301gAGjo1mZ40PEFgAEBigEDVVNEkgEDVVNEmAGsAqAB-gGoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQCKAml1ZignYScsIDY5MDM4ODYsIDApO3VmKCdpJywgNzg2MzY4OCwgMCk7dWYoJ2cnLCAxOTgyNzk5MiwgMCk7dWYoJ3MnLCAyODc2Nzg2NjksIDApO3VmKCdyJywgNDYxMjQ3MDIxLCAwKTuSAvkFIXFKYjBzZ2pzekpJYUVLMmstTnNCR0FBZ21OOU5NQUE0QUVBQVNJZGRVSjJRMUExWUFHQ2lBMmdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCZG81Yy1UZFZ6al9CQWMtcUk4MC1fODhfeVFFQUFBQUFBQUR3UDlrQjJldmRILTlWN2pfZ0FZajczd1AxQVFBQUlFQ1lBZ0NnQWdHMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQW9MYTFDdm9BbzItN3FrRy1BSUFnQU1CbUFNQm9nTVhDTzJ5MkN3UUFoZ0JMUUFBQUFBeUIyUmxabUYxYkhTaUF3NElndHJVS3hBSUdBQXRZQ0hDUGFJRERnaUMydFFyRUFrWUFDMWdJY0k5b2dNT0NJVGExQ3NRQ2hnQUxRQUFnRC1pQXc0STVkUzZLaEFMR0FJdEFBQUFBTG9EQ1VGTlV6TTZOakF4TWVBRDZrU0FCUGJZNXd1SUJQM1k1d3VRQkFHWUJBR3lCQWtJbXBCTEVNdmZ2dzI2QkJrSWhRUVJ3X1VvWElfQ3hUOFpBQUFBQUFBQUFBQWdtcEJMdWdRYUNLNWFFUUFBQQUXDEFBR1ENCWBDeEFJTXJVanhEQkJNUDFLRnlQd3NVX3lRESEkQXNRTmdFQVBFRQ0yUEFBQUNJQmZzdW1BWE53WmFKQWFrRgEWAQEQOEQteEIVOxBBQXdRVQEXAQEIRVFNLigABF9SLigAADINKMhMRVM0UC1BRnBzTUI4QVdZbXJvSi1BWE9zS1VEZ2dZRFJWVlNpQVlBa0FZQm1BWUFvUVkBXAEBLEVRS2dHQkxJR0pBawEQCQEAQh23BEJrCRQBAQBDHRgYTGdHQ29FSQEXBEFEQZCYOC6aApkBIWp4cVhsd2pzekpJYUVLMmstTnNCR0pqZlRTQUFLQUF4BTEEQUEBZHg2Q1VGTlV6TTZOakF4TVVEcVJFblo2OTBmNzFYdVAxHW0ARh2FMEdIRDlTaGNqOExGUDIVGAhzUUgdMBBIZ0FpUREQ9BcBRHdQdy4u2AK8lAPgArCyXuoCHWh0dHBzOi8vd3d3LmRhaWx5ZmFjZW9mZi5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAPYBMgDANgD1v0j4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDTQ1LjE0MS4xNTIuNzeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQPMTE5MTEjQU1TMzo2MDEx2gQCCAHgBAHwBK2k-NsBiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAF8b8E-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBuqRAdoGFgoQAAUSGQFwEAAYAOAGAfIGAggAgAcBiAcAoAcByAfQ8QXSBw0VZQEmCNoHBgFeyBgA4AcA6gcCCADwB9LgA4oIAhAAlQgAAIA_mAgBwAi8lAPSCA4IgYKEiJCgwIABEAAYAA..&s=41ce0d6313bb3ac6d66d9448741fd2e99baecb3a&type=nv&nvt=5&jm=1003&px=1124&py=1591&bw=300&bh=250&sid=6378719511546066867&vd=ct~0|rr~0&sv=239&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28641309&sw=1600&sh=1200&pw=1600&ph=2265&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/239/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
an-x-request-uuid: 3567650e-a454-49d6-80e2-33d321e6e9ce
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 9534-e86df2f088a2406b.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 44 KB
11 KB 46ms
33ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/9534-e86df2f088a2406b.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfc7613cf6cbe9af2ae4fdd0fa577120b30b135709bf8d03d16496dec9640f69

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 1575647
content-disposition: inline; filename="9534-e86df2f088a2406b.js"
x-vercel-id: gru1::l97bx-1690499737111-3b8567c4f810
server: cloudflare
x-matched-path: /_next/static/chunks/9534-e86df2f088a2406b.js
etag: W/"0f8e4a4e7b71506d0051bc9abe971e8c"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8bff55bf1-FRA

GET
H2 200 6595-70557aa686731784.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 10 KB
4 KB 40ms
27ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/6595-70557aa686731784.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d98915ed3cb9a5adbc271b167919c3f6d3dbafb4d690cb77c5765998e3dddb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 18427509
content-disposition: inline; filename="6595-70557aa686731784.js"
x-vercel-id: syd1:syd1::mtdbt-1680015842881-7cb2140754ee
server: cloudflare
x-matched-path: /_next/static/chunks/6595-70557aa686731784.js
etag: W/"5fc5cd10efe07b51e346a1c38c288514"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8bff65bf1-FRA

GET
H2 200 5935-987f64999aab59aa.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 30 KB
11 KB 38ms
25ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/5935-987f64999aab59aa.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1499460ce5ec80dad274437e10869a4930ca9c892cb852ba90efc3464767b51f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
content-encoding: br
strict-transport-security: max-age=63072000
cf-cache-status: HIT
age: 249700
content-disposition: inline; filename="5935-987f64999aab59aa.js"
x-vercel-id: fra1::5kzlj-1698194507519-2a089a17d8d3
server: cloudflare
x-matched-path: /_next/static/chunks/5935-987f64999aab59aa.js
etag: W/"f202a2414de30c56bbcc4dbebb1a1f5a"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8bff75bf1-FRA

GET
H2 200 8852-cb6876ee41f3648f.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 22 KB
5 KB 40ms
36ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/8852-cb6876ee41f3648f.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b38b7f9c7847bf7cbafc5d23579e6604b26ef0cacdb6910074734d576ba4db1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 3113975
content-disposition: inline; filename="8852-cb6876ee41f3648f.js"
x-vercel-id: gru1::84dnv-1695328828290-9d1c7014537e
server: cloudflare
x-matched-path: /_next/static/chunks/8852-cb6876ee41f3648f.js
etag: W/"c4377bd48371f549a140c5f309b2f4f4"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8bff85bf1-FRA

GET
H2 200 6932-fb9f10300a0440b6.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 101 KB
32 KB 33ms
29ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/6932-fb9f10300a0440b6.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

461d9d9ddb4829b826ede451b55580827053e6b4ec75b2c44fce2673e5b75fdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 1492086
content-disposition: inline; filename="6932-fb9f10300a0440b6.js"
x-vercel-id: gru1::qm4jl-1696950962789-0f6956ede05a
server: cloudflare
x-matched-path: /_next/static/chunks/6932-fb9f10300a0440b6.js
etag: W/"6e1c14d49c1a4dc5791dafaeeb5a5063"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8bff95bf1-FRA

GET
H2 200 8715-829ce80c7175ab12.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 24 KB
7 KB 38ms
34ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/8715-829ce80c7175ab12.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9e1d50b07a89e8f38a392ade671edd2fc8600a511745b877df5d4f0ba5997ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 1492265
content-disposition: inline; filename="8715-829ce80c7175ab12.js"
x-vercel-id: gru1::jbv7f-1696951283321-37543f13ea78
server: cloudflare
x-matched-path: /_next/static/chunks/8715-829ce80c7175ab12.js
etag: W/"57ea8f61f10a35f06f60914dd52829c0"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8bffa5bf1-FRA

GET
H2 200 %5Bslug%5D-ab23c5c8074ca39e.js Show response
www.dailyfaceoff.com/_next/static/chunks/pages/news/ 13 KB
5 KB 32ms
28ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/pages/news/%5Bslug%5D-ab23c5c8074ca39e.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a84bde1fe730fb30eb7ec5f5d358d16f9438ee40309e57e20bf93a2f86b3b732

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 1492085
content-disposition: inline; filename="[slug]-ab23c5c8074ca39e.js"
x-vercel-id: gru1::jbhp5-1696950964263-f3dc53677876
server: cloudflare
x-matched-path: /_next/static/chunks/pages/news/%5Bslug%5D-ab23c5c8074ca39e.js
etag: W/"03e31903743ef15b7ffa27f8b945b4e4"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8bffb5bf1-FRA

GET
H2 200 %5Bslug%5D-ad0d7229dab41a88.js Show response
www.dailyfaceoff.com/_next/static/chunks/pages/authors/ 10 KB
4 KB 31ms
30ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/pages/authors/%5Bslug%5D-ad0d7229dab41a88.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c6d187ecaded849274b37ffafaf89fed00521487d2bb63302bfc7994cee4146

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
content-encoding: br
strict-transport-security: max-age=63072000
cf-cache-status: HIT
age: 250341
content-disposition: inline; filename="[slug]-ad0d7229dab41a88.js"
x-vercel-id: fra1::p5pn5-1698193866769-d3460d33d505
server: cloudflare
x-matched-path: /_next/static/chunks/pages/authors/%5Bslug%5D-ad0d7229dab41a88.js
etag: W/"8a73fadd234dc61ae5a246b4c47140ce"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8c8025bf1-FRA

GET
H2 200 %5Bslug%5D-4f9a06131d4354e0.js Show response
www.dailyfaceoff.com/_next/static/chunks/pages/categories/ 2 KB
1 KB 42ms
23ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/pages/categories/%5Bslug%5D-4f9a06131d4354e0.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2046d0dffaaff13d278ded237ca0480d379f691f8c46017da3d383736d50e23

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 2729247
content-disposition: inline; filename="[slug]-4f9a06131d4354e0.js"
x-vercel-id: gru1::sgxjq-1695710442719-48996a25e66b
server: cloudflare
x-matched-path: /_next/static/chunks/pages/categories/%5Bslug%5D-4f9a06131d4354e0.js
etag: W/"740547ad66f265974028a58ecf8e219f"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8f8285bf1-FRA

GET
H2 200 5761-ac0d245560f2ff39.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 9 KB
3 KB 44ms
25ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/5761-ac0d245560f2ff39.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce76230f57c0a5804fe4a894fdc4dc763019463eb7fb545e3f75fe5df7f2572e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 7092521
content-disposition: inline; filename="5761-ac0d245560f2ff39.js"
x-vercel-id: gru1::qgw56-1691351103500-e9b0e208b310
server: cloudflare
x-matched-path: /_next/static/chunks/5761-ac0d245560f2ff39.js
etag: W/"83c50bee50173b8347bcbab533cae47a"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8f8295bf1-FRA

GET
H2 200 %5B%5B...params%5D%5D-795bc57b69ba0e69.js Show response
www.dailyfaceoff.com/_next/static/chunks/pages/hockey-player-news/ 4 KB
2 KB 42ms
24ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/pages/hockey-player-news/%5B%5B...params%5D%5D-795bc57b69ba0e69.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a3b7a345b18da5b6360c15ddca29408d6883d8b701933ccd87aade7cf013650

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 4110019
content-disposition: inline; filename="[[...params]]-795bc57b69ba0e69.js"
x-vercel-id: syd1:syd1::gc8nt-1683565450942-0c6f25c4e39b
server: cloudflare
x-matched-path: /_next/static/chunks/pages/hockey-player-news/%5B%5B...params%5D%5D-795bc57b69ba0e69.js
etag: W/"af9da9f039217d60eaf6f803c8c41149"
x-vercel-cache: MISS
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8f82c5bf1-FRA

GET
H2 200 374-afa99051b8f32278.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 90 KB
10 KB 40ms
29ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/374-afa99051b8f32278.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f97c1f41fd7fe19224ec65bc340835a8901df80a9136bb26b9aa2549293f9585

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 18427506
content-disposition: inline; filename="374-afa99051b8f32278.js"
x-vercel-id: syd1:syd1::t6bhs-1680015846216-236217800763
server: cloudflare
x-matched-path: /_next/static/chunks/374-afa99051b8f32278.js
etag: W/"79f85b1db20e67f4343d8a6733d99904"
x-vercel-cache: MISS
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8f82d5bf1-FRA

GET
H2 200 878-2455321700c408f9.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 15 KB
5 KB 38ms
28ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/878-2455321700c408f9.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65534fdafbad9cb1acca833772bc23a5d03e1a89f1ae44f34699b522e023a11e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 2759216
content-disposition: inline; filename="878-2455321700c408f9.js"
x-vercel-id: gru1::ck8tk-1695683989238-0ec26c7549ec
server: cloudflare
x-matched-path: /_next/static/chunks/878-2455321700c408f9.js
etag: W/"5b098f564887aced852856f218635be0"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8f82f5bf1-FRA

GET
H2 200 %5B%5B...date%5D%5D-a74aa9694d5b8077.js Show response
www.dailyfaceoff.com/_next/static/chunks/pages/starting-goalies/ 21 KB
7 KB 36ms
26ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/pages/starting-goalies/%5B%5B...date%5D%5D-a74aa9694d5b8077.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97a7f1daf10f16f2e3e0b95440ffe6d0f1fe0b2f9f8c94d5a0158a266553f878

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 1468247
content-disposition: inline; filename="[[...date]]-a74aa9694d5b8077.js"
x-vercel-id: gru1::vj9dp-1696975531369-acddbf8e89c1
server: cloudflare
x-matched-path: /_next/static/chunks/pages/starting-goalies/%5B%5B...date%5D%5D-a74aa9694d5b8077.js
etag: W/"e5f481a3ed6a71a71004c4bd6062fc75"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa8f8305bf1-FRA

GET
H2 200 4151-9e344b2b9cae2770.js Show response
www.dailyfaceoff.com/_next/static/chunks/ 22 KB
6 KB 22ms
21ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/4151-9e344b2b9cae2770.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5d262d92e543246a595d1b20ad250ffc44d0a4efc568d42c4dc39cb36bcc65e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 4110019
content-disposition: inline; filename="4151-9e344b2b9cae2770.js"
x-vercel-id: gru1::mkj9x-1694128394807-0162f6d5ee8e
server: cloudflare
x-matched-path: /_next/static/chunks/4151-9e344b2b9cae2770.js
etag: W/"f3199da89ac97ea9259d3a8d2ac83f8e"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa988e65bf1-FRA

GET
H2 200 nhl-weekly-schedule-bac0295831efb757.js Show response
www.dailyfaceoff.com/_next/static/chunks/pages/ 414 B
471 B 20ms
20ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/pages/nhl-weekly-schedule-bac0295831efb757.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

faeeb447489a22cb3134f5801c870b878a0ffb3d159b7c25d3d591c8ff4aa36c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 4110019
content-disposition: inline; filename="nhl-weekly-schedule-bac0295831efb757.js"
x-vercel-id: gru1::v4qqq-1686742631797-4df456b677c8
server: cloudflare
x-matched-path: /_next/static/chunks/pages/nhl-weekly-schedule-bac0295831efb757.js
etag: W/"59330b45e2f3cbcfa841df73b8ee8cbd"
x-vercel-cache: MISS
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa988e75bf1-FRA

GET
H2 200 teams-39d84c01efe361c5.js Show response
www.dailyfaceoff.com/_next/static/chunks/pages/ 10 KB
3 KB 22ms
22ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/pages/teams-39d84c01efe361c5.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10d94a22970df2a98d64662d138f8b6f1a5daa5782171d5de312fd06a850d9f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000
content-encoding: br
cf-cache-status: HIT
age: 582129
content-disposition: inline; filename="teams-39d84c01efe361c5.js"
x-vercel-id: gru1::6h5hx-1691351101531-a2b9c4bdfb5e
server: cloudflare
x-matched-path: /_next/static/chunks/pages/teams-39d84c01efe361c5.js
etag: W/"d17e5b4e50ef3573be47d9477cc64ac2"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aa998e85bf1-FRA

POST
H2 200 prebid Show response
id5-sync.com/api/config/ Frame 3EF7 135 B
421 B 42ms
8ms XHR
application/json 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

25359cb3d49c2e00cb2e97f95643ee30748d54c33daa11c9c6fb0d2b519dfffa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:26 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ Frame 3EF7 0
0

GET
H2 200 id Show response
id.crwdcntrl.net/ Frame 3EF7 43 B
320 B 47ms
30ms XHR
application/json 52.210.247.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.247.62 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-247-62.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache
x-server: 10.45.5.159
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ Frame 3EF7 63 B
426 B 118ms
33ms XHR
application/json 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=j6w8ta9&fmt=json
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: dc8818ab3f05897ae6608c16085d6194ebc3e120ae3acf3c68bbcea020018008

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
expires: Sun, 26 Nov 2023 22:03:27 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 3D52 15 KB
6 KB 539ms
166ms Document
text/html 2.19.244.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.244.232 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-244-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=64796
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Fri, 27 Oct 2023 22:03:28 GMT
expires: Sat, 28 Oct 2023 16:03:24 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 9980 281 B
554 B 57ms
8ms Document
text/html 23.212.89.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=0
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.89.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-89-194.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 27 Oct 2023 22:03:27 GMT
ETag: "4014f-119-6051b805b8000"
Last-Modified: Mon, 11 Sep 2023 20:52:16 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 6224 3 KB
2 KB 46ms
14ms Document
text/html 172.64.149.180
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: www.dailyfaceoff.com
URL: https://www.dailyfaceoff.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.149.180 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1085
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 81ce3aaa29796adc-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 27 Oct 2023 22:03:27 GMT
expires: Sat, 28 Oct 2023 02:03:27 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 /
sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/ Frame 3EF7 95 B
237 B 98ms
12ms Image
image/png 162.55.236.224
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?referrer=https%3A%2F%2Fwww.dailyfaceoff.com%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.55.236.224 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.224.236.55.162.clients.your-server.de
Software: nginx / PHP/8.2.4
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: image/png
date: Fri, 27 Oct 2023 21:58:18 GMT
server: nginx
x-powered-by: PHP/8.2.4
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame AD59 0
10 B 9ms
8ms Image
text/plain 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?1A94fg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 204 csi
csi.gstatic.com/ Frame 5ECD 0
234 B 58ms
14ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lo95ttjz&c=727901353091&slotId=363950676545.5&eee=missing-element&bi=missing-id&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 3EF7 33 B
280 B 52ms
10ms XHR
application/json 141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

dde872fe6118bcfd6e6af73c59219670001dc90fc5a52845c24bc46b15727988

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:26 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 9980 40 KB
11 KB 12ms
11ms Script
text/html 23.212.89.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.89.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-89-194.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 03766113c60c5d25eafad8cdc67e574807b70422c26f95182d741020ab972326

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?gdpr=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Fri, 27 Oct 2023 22:03:27 GMT
Content-Encoding: gzip
Last-Modified: Fri, 27 Oct 2023 20:33:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=80930
Connection: keep-alive
Content-Length: 11052
Expires: Sat, 28 Oct 2023 20:32:17 GMT

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 2A18
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

2 KB
1 KB

22ms
22ms

Document
text/html

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d0d7fb08d7547fa79382cb831947edfad740c4ffecc9061f5ef4fc0ac198000

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 81ce3aaae835904e-FRA
content-encoding: br
content-type: text/html
date: Fri, 27 Oct 2023 22:03:27 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3EKJSpdCkUX%2B5PCd4xb0utyyKqIjpKi358GjJSKJ%2FWQUXRriEamkzOvoYSLMECQSnYCiCvhG3XrAkkZ9hrcGF6bD5%2BSZMbaGbRGlwvbJWEamoyxdtYvuIXkF8vNK0rIpEXJP19p6R%2Fvlyg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 81ce3aaabe86bbd4-FRA
content-length: 0
date: Fri, 27 Oct 2023 22:03:27 GMT
expires: 0
location: /usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rI4csAdy7lcRA4hiH0n1OzUcWY%2BjOUWJ6lLdJKFTGZEO4Y9UumnDi%2FWyAJwHVflZTSSMoExo5qQ8N8J4zv5W1WbbS75nb2zsYl99eKQNyh7%2FK1L%2FyEg7pn1T1iZw2fmWeXz%2Fq4eNcggs5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

POST
H2 200 212.json Show response
id5-sync.com/g/v2/ Frame 3EF7 276 B
562 B 29ms
10ms XHR
application/json 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/212.json

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

58675944f159bb03366620a058caccc73f8db99c00994e96b638dadd0551aed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 liveView.php
live.primis.tech/live/ 0
421 B 44ms
43ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTM2JaNypaZypyRcoWU9MTY5ODQ0NDIjNCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTEmNwp4JaN0YT0jJat9NwQjJax9NDQjJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzp2Reqw0zqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0jJzNwpGE9MCZwY3BuQ29hp2VhqD0zY2J1p3Rypw0kNwx4NDQ0MwA3ODAmJaVcZD1TZWgcozRiU1BfYXyypwY1M2MmM2FwZDYmMGQzpHVvVXJfPWu0qHBmJTNBJTJGJTJGq3q3LzRunWk5ZzFwZW9zZv5wo20yMxYzZzkiYXRTqGF0qXM9ZzFfp2UzZWyxp3A9pHJyYzyxJaB4nWQ9MTE2MDY3NTEmNt==
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: -Zb6JuJIRZEbFGLTCoTQh17Y9Mz5N3HdDJGfkn57Y9Rn-7DL4rxS2w==

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 5ECD 115 KB
20 KB 317ms
316ms XHR
text/xml 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F21734706084%2C22671245338%2Ffutbolsites&description_url=https%3A%2F%2Fwww.dailyfaceoff.com%2F&env=vp&correlator=1143668415600860&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1%7C213x120&unviewed_position_start=1&ad_rule=0&cust_params=prmsig%3Dwdvsfe&sdkv=h.3.599.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&u_so=l&ctv=0&sdki=445&ptt=20&adk=4099075284&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.599.0&sid=67FBD55A-AE9C-4E55-B9FC-550D0D930F7D&nel=0&eid=44772139%2C44777649%2C44781409%2C44802463%2C44806075&ref=https%3A%2F%2Fwww.dailyfaceoff.com%2F&url=https%3A%2F%2Fwww.dailyfaceoff.com%2F&dlt=1698444204693&idt=2425&dt=1698444207807&cookie=ID%3D308d2f0f8c1e4dbc%3AT%3D1698444206%3ART%3D1698444206%3AS%3DALNI_MYu3bQ2peP66yA41sAPxUM9Lh0Dug&gpic=UID%3D00000caa4952bf1e%3AT%3D1698444206%3ART%3D1698444206%3AS%3DALNI_MaODL0aDXhX8rpDJAd_zD98WePjbQ&scor=3745081227201634&ged=ve4_td3_tt1_pd3_la3000_er581.-2600.734.-2300_vi0.0.1200.1600_vp0_ts1_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84b9ce33e46b56d2618938dfa42e575f80f8a1ddf31ed0a559258892b5279c66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:28 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20005
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 93 KB
30 KB 56ms
25ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0c1ce1aa8e07e9cd49cd881147c0495b5c636dab10ab1c30ceb935b74a8c0ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 19 May 2023 17:15:21 GMT
server: nginx
etag: W/"6467aea9-175c4"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 28 Oct 2023 22:03:27 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 9980 7 B
380 B 60ms
9ms XHR
application/json 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?gdpr=0
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
Expires: 0

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 2A18
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZTwzr3PgpIElCasoWgOXSQAADQ8AAAIB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZTwzr3PgpIElCasoWgOXSQAADQ8AAAIB&gpp=&gpp_sid=&dcc=t

43 B
855 B

146ms
145ms

Image
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZTwzr3PgpIElCasoWgOXSQAADQ8AAAIB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 27 Oct 2023 22:03:28 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: V13K4CQENSYPHEXC6PSA
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 27 Oct 2023 22:03:28 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: VV0SR3BDT6RBA6YWGTFR
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZTwzr3PgpIElCasoWgOXSQAADQ8AAAIB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 2A18
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZTwzr3PgpIElCasoWgOXSQAADQ8AAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESENsLMD1oV4qw8WxmpZSrAfU&google_cver=1

43 B
733 B

22ms
21ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESENsLMD1oV4qw8WxmpZSrAfU&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eCqaCc5TmnA0AmKS%2FwFQ1D0NkufOfXqikuBGIyreljV4TBEejZFnP5kG5hLkCRMsXZ5%2BpIzdlaPvQJVG%2F2Q%2BAvG2lssYfF0rRKfJue2FiY66LfQjMlWJc1OHPSJJ9opARidFig7bK7DMcw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3aab88b8904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESENsLMD1oV4qw8WxmpZSrAfU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 2A18
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZTwzr3PgpIElCasoWgOXSQAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELUZvnAtLJuxpwr7zyBGo-4&google_cver=1

43 B
731 B

24ms
23ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELUZvnAtLJuxpwr7zyBGo-4&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kTxbJMAbxq4YkA5TOB%2Fx06b7AVhcKLB%2Flcuq1Mo9v42My1APmzGeGu7Eih97eRFA%2FCORp25i5jtgYpF6fezo5nuTb4lu5KoJdevaeBDrifv8U7tJCwNOo94t6FvU%2Flw60hJKaB7ZQPCVYA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3aaba8e5904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESELUZvnAtLJuxpwr7zyBGo-4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

28292
i6.liadm.com/s/ Frame 2A18
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZTwzr3PgpIElCasoWgOXSQAA%263343&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZTwzr3PgpIElCasoWgOXSQAA%263343&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=b63a2fc8bd904a64816f4163a2633169
https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-PpDxrWPl599_UvvEwiKxZZfGmuW9sNUOXLjlaw
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-PpDxrWPl599_UvvEwiKxZZfGmuW9sNUOXLjlaw

43 B
548 B

420ms
97ms

Image
image/gif

2600:1f18:ed:550e:78e7:c13b:e422:f8d2
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-PpDxrWPl599_UvvEwiKxZZfGmuW9sNUOXLjlaw

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Server

2600:1f18:ed:550e:78e7:c13b:e422:f8d2 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Fri, 27 Oct 2023 22:03:30 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 0
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-PpDxrWPl599_UvvEwiKxZZfGmuW9sNUOXLjlaw
Date: Fri, 27 Oct 2023 22:03:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 4

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 2A18
Redirect Chain

https://creativecdn.com/cm-notify?pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZTwzr3PgpIElCasoWgOXSQAA%263343
https://creativecdn.com/cm-notify?pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZTwzr3PgpIElCasoWgOXSQAA%263343&tc=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=rnt1kAa0n2eG09etZIkK&pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZTwzr3PgpIElCasoWgOXSQAA%263343&tc=1

43 B
734 B

27ms
26ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=rnt1kAa0n2eG09etZIkK&pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZTwzr3PgpIElCasoWgOXSQAA%263343&tc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6hxcdJ%2FG4O9dXT%2F3B5Ft2RT7tagGRd%2B7jWi9vuvF8ThD8fyy4dgCwb4uwqcNr0NgNLzT9u1QyPeRT18ZiNtkH5abYAg0D8o9kVuMQPQ9i%2Fa4oDegs0A%2Bqxli8MNEgkqSZk9nBef%2BFI721g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3aaba8f3904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=133&external_user_id=rnt1kAa0n2eG09etZIkK&pi=index&gpdr=&gdpr_consent=&us_privacy=&user_id=ZTwzr3PgpIElCasoWgOXSQAA%263343&tc=1
pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT, Fri, 27 Oct 2023 22:03:27 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame 2A18
Redirect Chain

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=ZTwzr3PgpIElCasoWgOXSQAA%263343?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZTwzr3PgpIElCasoWgOXSQAA%263343

42 B
943 B

51ms
50ms

Image
image/gif

34.253.158.202
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZTwzr3PgpIElCasoWgOXSQAA%263343

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Server

34.253.158.202 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-253-158-202.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v053-0da6b0dfe.edge-irl1.demdex.com 19 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: uznw5u2ZSO4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v053-0504e7d35.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: Pxcd7jV2Rzg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZTwzr3PgpIElCasoWgOXSQAA%263343
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 2A18
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=

43 B
742 B

23ms
22ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:28 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6TKVosWuDrL0Jy0FUvMOzm1N2d1uI9K%2FNjsmdcnddXqB%2FKZNxnGCR036L9JK9VlP%2F3Uoake%2BlC%2B4BSbUGU7QMSkxUku07lcBqKqGdLu%2BJavhNtoT%2B%2F8fmk%2F320%2FZleO8TXNidkwIrsECXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3aad7a3a904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=
Pragma: no-cache
Date: Fri, 27 Oct 2023 22:03:28 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Content-Length: 95
Content-Type: text/html; charset=utf-8

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2A18
Redirect Chain

https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=9a1b8b12-ce9b-4c62-b5ba-1919f51b1ddc&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null

43 B
475 B

22ms
21ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=9a1b8b12-ce9b-4c62-b5ba-1919f51b1ddc&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jJGiw88NBykYpFlAiH7zEp%2BH4WieFqi8bDelO%2FC2yidV5iCPXTsSS9ophDuETag8ztyKNyfb2dNUo%2FK%2F4frKpfKV8kj4s2Ld4i52vYars%2BWpzR2evD9U2OdchyqT9yu3AmzcEOGxzYkhnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3aab98ce904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=9a1b8b12-ce9b-4c62-b5ba-1919f51b1ddc&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
date: Fri, 27 Oct 2023 22:03:27 GMT
server: _
content-length: 0

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 2A18 43 B
228 B 23ms
13ms Image
image/gif 172.64.149.180
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZTwzr3PgpIElCasoWgOXSQAA%263343
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.149.180 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 397
etag: "da1f1d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 81ce3aab3a526adc-FRA
content-length: 43
expires: Sat, 28 Oct 2023 22:03:27 GMT

GET
H2 200 projections-55fc3d09697af711.js Show response
www.dailyfaceoff.com/_next/static/chunks/pages/ 4 KB
2 KB 20ms
19ms Script
application/javascript 2606:4700:10::ac43:7b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dailyfaceoff.com/_next/static/chunks/pages/projections-55fc3d09697af711.js

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:7b0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

06d3bb19645c6af96a0180f8eb4067f9133d372c078877ff2bc4ee006ed636a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
content-encoding: br
strict-transport-security: max-age=63072000
cf-cache-status: HIT
age: 137498
content-disposition: inline; filename="projections-55fc3d09697af711.js"
x-vercel-id: fra1::65rrv-1698306709016-32dce8d23cd0
server: cloudflare
x-matched-path: /_next/static/chunks/pages/projections-55fc3d09697af711.js
etag: W/"9ac59e13eaed3ad159a8f5e412c5782d"
x-vercel-cache: HIT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 81ce3aab3a235bf1-FRA

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 352A 15 KB
6 KB 46ms
14ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.dailyfaceoff.com

Requested by

Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 22:03:27 GMT
server: Kestrel
server-processing-duration-in-ticks: 310173
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.136.js Show response
static.criteo.net/js/ld/ 93 KB
30 KB 54ms
28ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.136.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.136.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0c1ce1aa8e07e9cd49cd881147c0495b5c636dab10ab1c30ceb935b74a8c0ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 19 May 2023 17:15:21 GMT
server: nginx
etag: W/"6467aea9-175c4"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 28 Oct 2023 22:03:27 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 352A
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=dailyfaceoff.com&sn=ChromeSyncframe&so=0&topUrl=www.dailyfaceoff.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=i39id3xvaC9jR2NDQzNKK1habFNMUlRPQWxYN1phOUlORU9hVTV0ODBPTXRlbzlKSGN6MldGK3lhbWxFdFFCSEVXUEVIYjdLV2dFdm1LQzNOdGQzbjZTcjlQK1JLa0RKMWcxQjBNWHBTVkhJdmJhUHFEUDhzVkJrc25OWU...

463 B
690 B

17ms
14ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=i39id3xvaC9jR2NDQzNKK1habFNMUlRPQWxYN1phOUlORU9hVTV0ODBPTXRlbzlKSGN6MldGK3lhbWxFdFFCSEVXUEVIYjdLV2dFdm1LQzNOdGQzbjZTcjlQK1JLa0RKMWcxQjBNWHBTVkhJdmJhUHFEUDhzVkJrc25OWUpTc3N2NENESU85K0IrK05Odk9TazZOaUtQc3lWaGpFT3I4THRwRjVqNXd0Vlh5RDdCWkZQYlBmTXoyT3ZVQXFPRis2ZFVXcWJoTHE0bU5mZGtzbWIxTWdpY29KaVlvMVVCRGt4ZXZkdldKT3RZeXpBWmdKdGk3TkI3U2d0UzBkZGc2Sk5iSDJPZjR4VmpVNjUxd1BYc1UwNkdTVEJZSjdNNWIvajFDY3RTWkdJZlJpY0VBWT18&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4c26159db4251ab0d14fc6a849a6411ddc16ffb0cdd54a09e8a03ed9f6993f51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1108892
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:27 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=i39id3xvaC9jR2NDQzNKK1habFNMUlRPQWxYN1phOUlORU9hVTV0ODBPTXRlbzlKSGN6MldGK3lhbWxFdFFCSEVXUEVIYjdLV2dFdm1LQzNOdGQzbjZTcjlQK1JLa0RKMWcxQjBNWHBTVkhJdmJhUHFEUDhzVkJrc25OWUpTc3N2NENESU85K0IrK05Odk9TazZOaUtQc3lWaGpFT3I4THRwRjVqNXd0Vlh5RDdCWkZQYlBmTXoyT3ZVQXFPRis2ZFVXcWJoTHE0bU5mZGtzbWIxTWdpY29KaVlvMVVCRGt4ZXZkdldKT3RZeXpBWmdKdGk3TkI3U2d0UzBkZGc2Sk5iSDJPZjR4VmpVNjUxd1BYc1UwNkdTVEJZSjdNNWIvajFDY3RTWkdJZlJpY0VBWT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 296708
content-length: 0
expires: 0

POST
H2 204 csi
csi.gstatic.com/ Frame 5ECD 0
54 B 15ms
14ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lo95tu0s&c=727901353091&slotId=363950676545.5&ghmsh_eids=44772139%2C44777649%2C44781409%2C44802463%2C44806075&icc=1&icrh=0&icri=0&icrs=1&icru=0&icp=GoogleWhyThisAd&icdi=18x18&vmfc=3&vhc=0&wta=1&ytext_viu=0&ytext_hd=1&hghme=1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 5ECD 0
17 B 15ms
14ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=3~lo95tudn&c=727901353091&slotId=363950676545.5&qqid=CKT9t92dl4IDFWiLgwcd5HwEFw&gqid=rzM8Zbz0MdSRjuwPnPCbOA&fb=ima_html5-lima&sdkv=h.3.599.0&mrd=4&aab=0&itv=1&met.4=ghmsh_s.lo95tudv~ghmsh_s.lo95tudw&ghmsh_hd=1&ghmsh_mi=22%2C18%2C&ghmsh_vi=134%2C136%2C243%2C247%2C396%2C398%2C&ghmsh_ai=139%2C140%2C250%2C&ghmsh_gvt=0&ams=1&vs=1280x720&vc=avc1.64001F&mt=video%2Fmp4&vsrc=youtube&bit=22&cpn=rynfzjBT0iMi9O1-
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 43 B
472 B 26ms
24ms Image
image/gif 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTI2JaNypaZypyRcoWU9MTY5ODQ0NDIjNSZ2nWRspGkurWVlVzVlPTMhMS4jJaM9NTtjNTpzp3RuPTE2NwAmMTI2Jat9NwU2Jax9MmY5Jz1mqGE9MTplNTU1NDAzqzyxX3Zup3RUrXByPTMzqzyxX3ZcZXquYzyfnXR5U3RuqGU9MSZ2nWRspGFmp0RioWFcow13q3phZGFcoHyzYWNyo2ZzLzNioSZmqWJJZD13q3phZGFcoHyzYWNyo2ZzLzNioSZxZWJ1Z0yhZz9loWF0nW9hPSZcp0FjpD0jJaZcZF9uqGx9ZaV0Yz9fp2y0ZXMzqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZlqz49MwIkMCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZmp3BsYWRioT0zpGkuY2VgZW50U3RlZWFgVHyjZT0kJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMDtkNmUzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD0lMDx5NDUmODE3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:28 GMT
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
x-amz-cf-id: EJbT7Y5VRjjikxVtbHgprVKOsRpHVnY629xFRKrg0j1ApUdTtNwS-w==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
421 B 24ms
22ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTQkJaNypaZypyRcoWU9MTY5ODQ0NDIjNSZ2nWRspGkurWVlVzVlPTMhMS4jJaM9NTtjNTpzp3RuPTE2NwAmMTI2Jat9NwU2Jax9MmY5Jz1mqGE9MTplNTU1NDAzqzyxX3Zup3RUrXByPTMzqzyxX3ZcZXquYzyfnXR5U3RuqGU9MSZ2nWRspGFmp0RioWFcow13q3phZGFcoHyzYWNyo2ZzLzNioSZmqWJJZD13q3phZGFcoHyzYWNyo2ZzLzNioSZxZWJ1Z0yhZz9loWF0nW9hPSZcp0FjpD0jJaZcZF9uqGx9ZaV0Yz9fp2y0ZXMzqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZlqz49MwIkMCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZmp3BsYWRioT0zpGkuY2VgZW50U3RlZWFgVHyjZT0kJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMDtkNmYzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD0lMDUjMwM0NmQ1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:28 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: L4Vp5Vr4JygGpKUiF5AFwZdIXMgCDJZnthPipeQjRnpFTNmLUstPDw==

GET
H3 200 help_outline_white_24dp_with_3px_trbl_padding.png
imasdk.googleapis.com/formats/wta/ Frame 5ECD 453 B
478 B 10ms
8ms Image
image/png 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imasdk.googleapis.com/formats/wta/help_outline_white_24dp_with_3px_trbl_padding.png?wp=ca-video-pub-1320774679920841

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e519cc4b7b8fdc64a7aaafc1b808cde266a234205aac0d6c55589c12446d565e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 21:30:11 GMT
x-content-type-options: nosniff
age: 1997
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 453
x-xss-protection: 0
last-modified: Wed, 13 Oct 2021 14:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: image/png
cache-control: public, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 27 Oct 2023 22:20:11 GMT

GET
H2 200 APkrFKaTkYl0ISeJfdQOfrXEVXR7508EUZ4IPkOXq3_xPA=s48-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 5ECD 2 KB
2 KB 43ms
6ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/ytc/APkrFKaTkYl0ISeJfdQOfrXEVXR7508EUZ4IPkOXq3_xPA=s48-c-k-c0x00ffffff-no-rj

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

cab9e938cdad5a79fc01a94c8f53908163808402687a450311fd74d0d517ea01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 21:20:12 GMT
x-content-type-options: nosniff
age: 2596
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1633
x-xss-protection: 0
server: fife
etag: "v17f"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 28 Oct 2023 21:20:12 GMT

GET
H2 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
443 B 82ms
44ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CvF7jrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsSl9GuL7t3hblF8KY6RdeMK0drm6XnMuzc9pUtAmCTU73yen202ispFFwn3GJQ7_O4bl_7DxNC28424Cpn1lwAT33bCyygTgBAGIBd_MtPdMkgUICAMQAhgBUAGgBlSAB6OzxYwEqAfZtrECqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcBqAgB0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tMzMyMjA0MTkxNzc3Nzk5NpoJQmh0dHBzOi8vd3d3LmF1ZGlibGUuZGUvY2F0L0tyaW1pcy1UaHJpbGxlci1Ib2VyYnVlY2hlci8xNjIwOTkxMDAzMbEJWpn5y51i6uaACgPICwHQCw_gCwHaDBAKChCwnbKLta7cwDMSAgEDmg0BD6oNAkRFyA0B4g0TCOzjtt2dl4IDFWiLgwcd5HwEF7AT0tCOFdgTAtgUAdAVAZgWAagWAfgWAYAXAQ&sigh=_AElX9FZtWk&label=show_ad&sdkv=h.3.599.0&vci=CnEIARIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgdBZFNlbnNlIAQqDDYwODA0Njc1MjA1MjIMNjc3MzE0NDg3Njk0QMQCUiMQDyUAAKBBKAE6CzZEdWpMZGRzeGFnQglnb29nbGVhZHNQABgB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5ECD 0
0 55ms
44ms Image
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CwxzvrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBOACT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrFqARgRbwIPzWlcPTwBi5IZ--Afyzw9wD0yT0IdQnEaRNihV591x3cjVjRjLAtC-wCi5uiceionCFUzcmitfYmCVsON9bN9ciyWh3lSelbUQvty1lpeSReS_2nfRGppkvoybq2QV9LhgUheKtsZZse2yQFzuXfD6TlSnVDoYKoaJUHhgr-mfp_QMLTamAulAK7UNND83kapavKXjvMw875TKtGLR4c1tlQSlKTjK3269UJzjCad77G9Zyo1HnE4KcUCy5xuhoCF8uJsE6oLlQh8ULDVxyHkTGD88zWHdDNe0xXHv4Rhjw4HgmPtKeD76S9wWn0F548IkuHHLkJQLrlMmJ_Qj9Fi2y9aUc61LgqMAE992wssoE4AQBiAXfzLT3TJIFEwgSEAUYDzCoi7O73eXonegBUAGgBlSAB6OzxYwEqAfZtrECqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBDU216oCAHSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0zMzIyMDQxOTE3Nzc3OTk2mglpaHR0cHM6Ly93d3cuYXVkaWJsZS5kZS9jYXQvS3JpbWlzLVRocmlsbGVyLUhvZXJidWVjaGVyLzE2MjA5OTEwMDMxP3NvdXJjZV9jb2RlPURBV1BQMzBEVFJJQUw0MzkwOTE5MjMwMDVSgAoDyAsB4g0TCOzjtt2dl4IDFWiLgwcd5HwEF7AT0tCOFcITBhij-_SsKdgTAtgUAdAVAZgWAagWAYAXAbIXHgocCAASFHB1Yi05Nzg1ODM1NDcyNjU3ODA1GK3XbQ&sigh=Ji6QuHWxV98&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&ase=2&nis=4&cid=CAQSOwDICaaNfoRUiwQZvmBqobFb2SR8NlSau9ToXz3PD2F8c2KxpmMZoyk_Oq8cjzg-ORee26kIqC30XyzGGAE&vt=10&sdkv=h.3.599.0&vci=CnEIARIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgdBZFNlbnNlIAQqDDYwODA0Njc1MjA1MjIMNjc3MzE0NDg3Njk0QMQCUiMQDyUAAKBBKAE6CzZEdWpMZGRzeGFnQglnb29nbGVhZHNQABgB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

POST
H3 204 csi
csi.gstatic.com/ Frame 3EF7 0
17 B 15ms
14ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lo95ttbz&c=727901353091&slotId=363950676545.5&eee=missing-element&bi=missing-id
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 3D52 5 KB
6 KB 104ms
26ms Script
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=80638720&p=159835&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: f4033c8654d891b70f8402d7b2c19752ad70f943c9d05151abce2d3e2507c6ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Fri, 27 Oct 2023 22:03:27 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 206
Partial Content videoplayback
rr4---sn-4g5lznle.googlevideo.com/ 1 MB
1 MB 56ms
8ms Media
video/mp4 2a00:1450:4001:1d::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr4---sn-4g5lznle.googlevideo.com/videoplayback?expire=1698473008&ei=sDM8ZZzQBIq36dsPvMil2AI&ip=2001:ac8:20:3a00:1012:d5e0:a20f:6753&id=e83ba32dd76cc5a8&itag=22&source=youtube&requiressl=yes&xpc=Eghovf3BOnoBAQ==&mh=FD&mm=31&mn=sn-4g5lznle&ms=au&mv=m&mvi=4&pl=49&susc=gvp&acao=yes&ctier=L&mime=video/mp4&vprv=1&dur=20.062&lmt=1697676290816875&mt=1698443881&cpn=rynfzjBT0iMi9O1-&txp=5532434&sparams=expire,ei,ip,id,itag,source,requiressl,xpc,susc,acao,ctier,mime,vprv,dur,lmt&sig=AGM4YrMwRQIgT6cT1gPx82XGHXOeEfA-7NwRAVouFB_HYSHJT5H7NgYCIQDvsAt_aiep7JbMYuRjgPC13rS_2Ug1_SXXdmbn4HosIQ==&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AK1ks_kwRAIgWdPfenKFfiW7pmXx1b43eTSv7WmxG14s1y9Uu3VEEmECIDPQex3LF1hN-_c1k8dHWUpiV6AxpgAgmyOTgMsMLcoq

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:1d::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

8146d40c6b1a268cd9d07ec4b96c79c4912c7c96a57224448e826332109ca9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.dailyfaceoff.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Range: bytes=0-

Response headers

Date: Fri, 27 Oct 2023 22:03:28 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 19 Oct 2023 00:44:50 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-1338914/1338915
Cache-Control: private, max-age=28500
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 1338915
Expires: Fri, 27 Oct 2023 22:03:28 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 5ECD 0
17 B 18ms
15ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=4~lo95tue8&c=727901353091&slotId=363950676545.5&qqid=CKT9t92dl4IDFWiLgwcd5HwEFw&gqid=rzM8Zbz0MdSRjuwPnPCbOA&fb=ima_html5-lima&sdkv=h.3.599.0&mrd=4&aab=0&itv=1&ua_e=1&met.4=ghmsh_s.lo95tuea~vss_tr.12l
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame D4EF 0
595 B 14ms
13ms Script
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=7838&pub_id=997666&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=7838&pub_id=997666

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

49.158.204.35.bc.googleusercontent.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:28 GMT
an-x-request-uuid: c696359e-fb2a-4aba-ad2c-056ba5d62530
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 5103 52 KB
17 KB 20ms
20ms Document
text/html 23.211.9.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.211.9.60 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-9-60.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 27 Oct 2023 22:03:29 GMT
ETag: "623de86a-cf34"
Expires: Sat, 28 Oct 2023 22:03:31 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
X-Akamai-EW-Subworker: 8096267

GET
H2 204 isyn
prebid.a-mo.net/ Frame 947E 0
0 19ms
15ms Document
text/plain 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/isyn?gdpr_consent=&gdpr=0&us_privacy=&gpp=&gpp_sid=
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
date: Fri, 27 Oct 2023 22:03:29 GMT
server: envoy
vary: Accept-Encoding
x-envoy-upstream-service-time: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame F5B0 15 KB
6 KB 168ms
166ms Document
text/html 2.19.244.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.244.232 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-244-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=64795
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Fri, 27 Oct 2023 22:03:29 GMT
expires: Sat, 28 Oct 2023 16:03:24 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 25C3 52 KB
17 KB 36ms
22ms Document
text/html 23.211.9.60
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.211.9.60 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-9-60.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 27 Oct 2023 22:03:29 GMT
ETag: "623de86a-cf34"
Expires: Sat, 28 Oct 2023 22:03:31 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
X-Akamai-EW-Subworker: 8096267

GET
H2 200 pd Show response
futbolsites-d.openx.net/w/1.0/ Frame 1922 0
176 B 172ms
17ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://futbolsites-d.openx.net/w/1.0/pd
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Fri, 27 Oct 2023 22:03:29 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 sync Show response
eb2.3lift.com/ Frame E30C 37 B
140 B 142ms
15ms Document
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif
date: Fri, 27 Oct 2023 22:03:29 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 5FBF 281 B
554 B 9ms
7ms Document
text/html 23.212.89.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.89.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-89-194.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 27 Oct 2023 22:03:29 GMT
ETag: "4014f-119-6051b805b8000"
Last-Modified: Mon, 11 Sep 2023 20:52:16 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 6C72 3 KB
1 KB 33ms
32ms Document
text/html 172.64.149.180
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.149.180 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1087
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 81ce3ab66db16adc-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 27 Oct 2023 22:03:29 GMT
expires: Sat, 28 Oct 2023 02:03:29 GMT
last-modified: Mon, 25 Jul 2022 19:18:26 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
sync.richaudience.com/dcf3528a0b8aa83634892d50e91c306e/ Frame 5797 61 B
253 B 16ms
14ms Document
text/html 162.55.236.224
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.richaudience.com/dcf3528a0b8aa83634892d50e91c306e/?ord=30846396
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.55.236.224 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.224.236.55.162.clients.your-server.de
Software: nginx / PHP/8.2.4
Resource Hash: 0391042e0e111437f4a2dec7560098dbcc04b68df753281b207b3c956430c89c

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 27 Oct 2023 21:58:20 GMT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/8.2.4

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame EB9C 0
0 15ms
14ms Document
text/plain 216.52.2.30
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13418490
Requested by: Host: cadmus.script.ac
URL: https://cadmus.script.ac/dc19s0tq5ynbc/script.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 New York, United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.dailyfaceoff.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Fri, 27 Oct 2023 22:03:29 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap6ams1

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 20E1
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
245 B

114ms
15ms

Document
image/gif

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:28 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 22:03:29 GMT
expires: Fri, 27 Oct 2023 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 668422
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H/1.1 200
OK dcm Show response
aax-eu.amazon-adsystem.com/s/ Frame AC61 43 B
855 B 307ms
182ms Document
image/gif 52.95.125.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=B25261B6-EDE2-464E-8639-81237415D144&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.95.125.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Fri, 27 Oct 2023 22:03:29 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: CP7SV05HSBG3MJH2FDCH

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 2A5D
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=KDgkNS0-dWczbiA0LTg6by81cWUzPydmej4FAfWW

42 B
337 B

108ms
22ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=KDgkNS0-dWczbiA0LTg6by81cWUzPydmej4FAfWW
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Fri, 27 Oct 2023 22:03:29 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=KDgkNS0-dWczbiA0LTg6by81cWUzPydmej4FAfWW
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 088B
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8287462243405912418&gdpr=0&gdpr_consent=

42 B
218 B

117ms
18ms

Document
image/gif

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8287462243405912418&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:28 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 58baf68e-4dfa-4613-bc13-1c84ad2cef94
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8287462243405912418&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 240C
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=9&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7294762331752626332&gdpr=0&gdpr_consent=

42 B
298 B

55ms
17ms

Document
image/gif

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7294762331752626332&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:28 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Date: Fri, 27 Oct 2023 22:03:29 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7294762331752626332&gdpr=0&gdpr_consent=
Server: nginx
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E398
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=e7d5aa3a-5c9c-42a5-ae2f-cbc92edeebec&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=283&user_id=c8c7873d-751d-41d7-8ec2-a3e6b8637830&expires=1&user_group=2&ssp=pubmatic&bsw_param=e7d5aa3a-5c9c-42a5-ae2f-cbc92edeebec&gdpr=0&gdpr_consent=&gdpr_pd=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e7d5aa3a-5c9c-42a5-ae2f-cbc92edeebec&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
165 B

14ms
14ms

Document
text/html

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e7d5aa3a-5c9c-42a5-ae2f-cbc92edeebec&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Fri, 27 Oct 2023 22:03:29 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=e7d5aa3a-5c9c-42a5-ae2f-cbc92edeebec&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 140B
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=bc8HxRBXXpNR-zWPr5lWHS2NmE0&gdpr=0&gdpr_consent=

42 B
302 B

17ms
14ms

Document
image/gif

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=bc8HxRBXXpNR-zWPr5lWHS2NmE0&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Fri, 27 Oct 2023 22:03:30 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=bc8HxRBXXpNR-zWPr5lWHS2NmE0&gdpr=0&gdpr_consent=

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame B9F6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...

85 B
259 B

97ms
96ms

Document
image/png

151.101.130.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZTwzsQAACwH_FAAg
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Fri, 27 Oct 2023 22:03:30 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-fra-eddf8230042-FRA
x-timer: S1698444210.933178,VS0,VE90

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Fri, 27 Oct 2023 22:03:29 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZTwzsQAACwH_FAAg
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-fra-eddf8230042-FRA
x-timer: S1698444210.834391,VS0,VE90

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame EA44
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEOXBVN0tlR2NBQUJkdWg5dWtYZw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://bh.contextweb.com/bh/rtset?ev=AAD9pU7KeGcAABduh9ukXg&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_par...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAD9pU7KeGcAABduh9ukXg&pid=558502&do=add&gdpr=0
https://rtb-csync.smartadserver.com/redir?partneruserid=AAD9pU7KeGcAABduh9ukXg&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%2...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=2241806176921324299&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAD9pU7KeGcAABduh9ukXg&gdpr=0&gdpr_consent=

42 B
199 B

21ms
21ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAD9pU7KeGcAABduh9ukXg&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:30 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Fri, 27 Oct 2023 22:03:30 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAD9pU7KeGcAABduh9ukXg&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3D0E
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
93 B

107ms
26ms

Document
text/html

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 27 Oct 2023 22:03:28 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Fri, 27 Oct 2023 22:03:29 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame E864
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU17cce391a7f648d1ba482c07500c3f38

42 B
278 B

24ms
20ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU17cce391a7f648d1ba482c07500c3f38
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU17cce391a7f648d1ba482c07500c3f38
pragma: no-cache
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 5A3A
Redirect Chain

https://b1sync.zemanta.com/usersync/pubmatic/?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:&gdpr=0&gdpr_consent=&gdpr=0

42 B
264 B

60ms
16ms

Document
image/gif

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:&gdpr=0&gdpr_consent=&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 176
Content-Type: text/html; charset=utf-8
Date: Fri, 27 Oct 2023 22:03:29 GMT
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:&gdpr=0&gdpr_consent=&gdpr=0
Pragma: no-cache

GET
H2 200 bridge Show response
cm.adgrx.com/ Frame DDEA 43 B
283 B 225ms
14ms Document
image/gif 64.95.96.108
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 64.95.96.108 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 43
content-type: image/gif
date: Fri, 27 Oct 2023 22:03:29 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy
x-realserver-nx: ams-delivery-10

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame D675
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4935152712030784535

42 B
424 B

35ms
21ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4935152712030784535
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4935152712030784535
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame 5C5A 43 B
369 B 72ms
15ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Fri, 27 Oct 2023 22:03:28 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame F2A7
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5124322329214744540

42 B
273 B

22ms
21ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5124322329214744540
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:28 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Fri, 27 Oct 2023 22:03:29 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5124322329214744540
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 53B4 43 B
279 B 136ms
33ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Fri, 27 Oct 2023 22:03:29 GMT
Vary: Accept-Encoding
X-adserver-worker: ragnarok-016da08bedc3@version_1.575
X-core-time: 0ms
X-server-arch: v2

GET usersyncsupply
cm-supply-web.gammaplatform.com/adx/ Frame 1D10 0
0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 3298
Redirect Chain

https://green.erne.co/pubmatic/cm?gdpr=0&gdpr_consent=
https://pixel-eu.onaudience.com/?partner=270&smartmap=1&gdpr=0&gdpr_consent=&redirect=image2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw%26piggybackCookie%3D%25...
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/tpid=0a55622d38d4c33c/gdpr=0/gdpr_consent=?https%3A%2F%2Fpixel-eu.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%...
https://pixel-eu.onaudience.com/?partner=104&icm&cver&mapped=&gdpr=1&redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw%26piggybackCookie...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=39puKE4JagVVUXXQYSQWjYYj&gdpr=0&gdpr_consent=

42 B
281 B

22ms
21ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=39puKE4JagVVUXXQYSQWjYYj&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:30 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=39puKE4JagVVUXXQYSQWjYYj&gdpr=0&gdpr_consent=

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 3D52
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=slJhtu3iRk6GOYEjdBXRRA%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

15 KB
15 KB

168ms
165ms

Image
text/html

2.19.244.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Server: 2.19.244.232 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-244-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:30 GMT
content-encoding: gzip
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=64794
accept-ranges: bytes
content-length: 5606
expires: Sat, 28 Oct 2023 16:03:24 GMT

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:29 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 qmap
sync.crwdcntrl.net/ Frame 3D52 49 B
265 B 169ms
31ms Image
image/gif 54.77.223.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=B25261B6-EDE2-464E-8639-81237415D144&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.223.222 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-223-222.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:29 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.7.218
content-length: 49
expires: 0

GET
H2

204

ids
idsync.frontend.weborama.fr/ Frame 3D52
Redirect Chain

https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=
https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=&bounce=1&random=1064245090
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fidsync.frontend.weborama.fr%2Fids%3Fkey%3Dpubmatic%26value%3D%23PM_USER_ID&gdpr=0
https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=B25261B6-EDE2-464E-8639-81237415D144

0
284 B

51ms
15ms

Image
text/plain

34.111.131.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=B25261B6-EDE2-464E-8639-81237415D144
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Server: 34.111.131.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 239.131.111.34.bc.googleusercontent.com
Software: Weborama Collect Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:29 GMT
via: 1.1 google
last-modified: Fri, 27 Oct 2023 22:03:30 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

location: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=B25261B6-EDE2-464E-8639-81237415D144
date: Fri, 27 Oct 2023 22:03:30 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H/1.1

200

p
a.audrte.com/ Frame 3D52
Redirect Chain

https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=B25261B6-EDE2-464E-8639-81237415D144
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=aTAyYldFU3pEZnFTNi1VY3hUd211MUwwZw==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=8955987516037424013&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D
https://a.audrte.com/p

68 B
424 B

34ms
33ms

Image
image/png

54.72.74.77
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 54.72.74.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-74-77.eu-west-1.compute.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Fri, 27 Oct 2023 22:03:30 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Fri, 27 Oct 2023 22:03:30 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 3D52
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QjI1MjYxQjYtRURFMi00NjRFLTg2MzktODEyMzc0MTVEMTQ0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

24ms
22ms

Image
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:29 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 3D52
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEI5y3aCKxvcXpCVUddbRxSo&google_cver=1

42 B
268 B

25ms
24ms

Image
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEI5y3aCKxvcXpCVUddbRxSo&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:30 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:29 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEI5y3aCKxvcXpCVUddbRxSo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame 3D52 43 B
612 B 122ms
13ms Image
image/gif 35.204.158.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.158.49 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:29 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Thu, 26 Oct 2023 22:03:29 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 3D52
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=8955987516037424013

42 B
243 B

16ms
15ms

Image
image/gif

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=8955987516037424013
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=8955987516037424013
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 3D52 70 B
148 B 40ms
32ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:29 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 200 B25261B6-EDE2-464E-8639-81237415D144
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 3D52 43 B
426 B 178ms
41ms Image
image/gif 2a05:d018:d29:3605:3e4c:92f3:ccc6:dc3e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/B25261B6-EDE2-464E-8639-81237415D144?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:3e4c:92f3:ccc6:dc3e Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58292/ Frame 3D52 0
125 B 144ms
8ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=B25261B6-EDE2-464E-8639-81237415D144&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:29 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 3D52 0
187 B 122ms
14ms Image
text/plain 98.98.134.243
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.243 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Fri, 27 Oct 2023 22:03:29 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 3D52
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4294739934230002354&gdpr=0&gdpr_consent=&us_privacy=

1 B
200 B

17ms
15ms

Image
text/html

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4294739934230002354&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 27 Oct 2023 22:03:28 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4294739934230002354&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Fri, 27 Oct 2023 22:03:29 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 204 current
pubmatic-match.dotomi.com/match/bounce/ Frame 3D52 0
104 B 130ms
23ms Image
text/plain 2a02:fa8:8806:13::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=B25261B6-EDE2-464E-8639-81237415D144&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:29 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 3D52
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:5eab5d25-134c-4cbf-9beb-a7c140b66514&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

17ms
15ms

Image
image/gif

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:5eab5d25-134c-4cbf-9beb-a7c140b66514&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:29 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:5eab5d25-134c-4cbf-9beb-a7c140b66514&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Fri, 27 Oct 2023 22:03:29 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 46ms
43ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202310180103&jk=2420201654124190&bg=!wcKlwo3NAAbo5yKYyOc7ADQBe5WfOP66-uWQrJDD1Y3iG_YJUCiYmuK5hc2nztsgrNIbkYznE2Pb46d-IsX5xeUVz3QTAgAAAaFSAAAABGgBB5kCtAIZHFW3ElNYBONNjd_7VqLpISnSC26jCFR7CtKxHILGTWsmAvUXELNM3Y6IhiAlYO9Cm9mcuGlRjAjl8JAM2eJ2NU-f-JJ_7huYdZLSxmsa8CCTlED35a3zvrmVJB-uwBhyVdiK372MXQ3_wJBBhFgwCeNlo3Hjg9Ct3tPIMeCN-fIR0ZK7mJsuj9ACsPBpQE3mDk9klZhUAFBbs7IqAJfd6sLiA9I4OD9Kx_51t_J9pKF5dznzYuwbN2R-SOmSru4cUt7y51YlF3RPZmMX9kZmLGIhgykAcpiyEmVconuvUxTc9tJM6X3igm1E6lJLAvV6-cNcYQha6lPRX4MLPiPJxFj3zTidqX5ZVmnLIiJQZTU3GSYXq_7SBeQifvD5FW9UUOcuCC0jPa6Bog8od5i1aDI37uad7iY-CAd_UzQbLWown3zeEAdIsgvuKb-aiijx537Cv67S-TKbgujSBzOD8THkOoIh9v8XVOLKedXMm3J8USGc_aENFopibVCfNGHBLl82ua0PfkrNZmFECicLNHbvyEsT8-XPbzhG7Dbwg3mu6I8FiGB0xKAiE2ESnHC0nwqOK59iZCA0_GTxLpaVwu8_tvDNTE3WfZ2hBW8zADcD_LY_3ir1wUd9hvkwCrXtYihcyVpbHKQMJeJFCafnjTrbLorVllVbNf6pN0Phd0w6PdviJMoUg43r2kZ2CfKyD9Tj1lRtlFpYVGJdT6WtgcmO-4UWUO7oc_-_dfy7uiY0vzZchR1rJOaulkLpVSz-UqJn35dHBtIagB_ztIz5SYPSTpZa067Mv16wxO0r6xKkBtdNJR2PVhi5vZ16VZOcQAnnfrb__abuadsNC6zqT3jDH1QyUFIaGVnwtUzuKDw1wOOAS0MsFFx-xaGcNw2R8DGZbtiGMLxBfiWy1icP9tp-
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 5FBF 40 KB
11 KB 15ms
14ms Script
text/html 23.212.89.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.212.89.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-89-194.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 03766113c60c5d25eafad8cdc67e574807b70422c26f95182d741020ab972326

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Fri, 27 Oct 2023 22:03:30 GMT
Content-Encoding: gzip
Last-Modified: Fri, 27 Oct 2023 20:33:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=80927
Connection: keep-alive
Content-Length: 11052
Expires: Sat, 28 Oct 2023 20:32:17 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 5103 0
595 B 13ms
13ms Script
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:30 GMT
an-x-request-uuid: d0da60d6-7aa2-4f16-a5ca-9f00c44845bb
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 25C3 0
595 B 14ms
13ms Script
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-52-7-64-161.compute-1.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:30 GMT
an-x-request-uuid: a04949ca-8bfa-4780-97c0-0f933e9a145f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame E062 2 KB
1 KB 27ms
27ms Document
text/html 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 327119fd40afcac838ef7d83e3f2dc4441219f4eadf4d8ed87e191bf71cfe182

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 81ce3abdbd44904e-FRA
content-encoding: br
content-type: text/html
date: Fri, 27 Oct 2023 22:03:30 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kmyggYDInv5IzSTlXXXhFOlD4I%2BDDN8JEfl2T1gX97rup%2B9eNOKtDvI%2FIkCaAqH3r%2FIu7QpavGUJqh1ychTgmwHqhaKr3s56l5MYi23%2F%2BwiZBkBoDkHpBg%2F0jRpDiqmNSsjKCnonj2k7eg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
108 B 55ms
45ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CvF7jrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsSl9GuL7t3hblF8KY6RdeMK0drm6XnMuzc9pUtAmCTU73yen202ispFFwn3GJQ7_O4bl_7DxNC28424Cpn1lwAT33bCyygTgBAGIBd_MtPdMkgUICAMQAhgBUAGgBlSAB6OzxYwEqAfZtrECqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcBqAgB0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tMzMyMjA0MTkxNzc3Nzk5NpoJQmh0dHBzOi8vd3d3LmF1ZGlibGUuZGUvY2F0L0tyaW1pcy1UaHJpbGxlci1Ib2VyYnVlY2hlci8xNjIwOTkxMDAzMbEJWpn5y51i6uaACgPICwHQCw_gCwHaDBAKChCwnbKLta7cwDMSAgEDmg0BD6oNAkRFyA0B4g0TCOzjtt2dl4IDFWiLgwcd5HwEF7AT0tCOFdgTAtgUAdAVAZgWAagWAfgWAYAXAQ&sigh=_AElX9FZtWk&label=video_ad_loaded&sdkv=h.3.599.0&vci=CpUBCAESHnNlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldBoHQWRTZW5zZSAEKgw2MDgwNDY3NTIwNTIyDDY3NzMxNDQ4NzY5NEDEAlIjEA8lAACgQSgBOgs2RHVqTGRkc3hhZ0IJZ29vZ2xlYWRzUABaImRvdWJsZWNsaWNrYnlnb29nbGUuY29tLW9taWQtdmlkZW8YAQ..

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 5FBF 7 B
380 B 10ms
8ms XHR
application/json 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
Expires: 0

GET
H/1.1 200
OK 31327
i.liadm.com/s/ Frame E062 43 B
573 B 102ms
100ms Image
image/gif 52.7.64.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZTwzr3PgpIElCasoWgOXSQAA%263343&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.7.64.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Fri, 27 Oct 2023 22:03:31 GMT
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 43
Request-Time: 1
Content-Type: image/gif

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame E062 70 B
148 B 37ms
34ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:31 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 200 ZTwzr3PgpIElCasoWgOXSQAADQ8AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame E062 43 B
602 B 39ms
38ms Image
image/gif 2a05:d018:d29:3605:3e4c:92f3:ccc6:dc3e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZTwzr3PgpIElCasoWgOXSQAADQ8AAAIB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:3e4c:92f3:ccc6:dc3e Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:31 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E062
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8287462243405912418

43 B
732 B

24ms
23ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8287462243405912418
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HiUW9exZOv5j9jsOWwx0JW1tXqKJKkHRl4OZkPG5gHyS2zQYSFvWShhFqcJ9UOkyCQpdHNsu4hiMWRxycF0p%2BB36xv4m7yynF4G4fQLFH7c9O%2FMIJaqocDCfu2ei5vJQJJxnhqWaKJX8Eg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3ac3a8f0904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
an-x-request-uuid: f54d587e-52da-4555-a542-4df71f33e5b4
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=8287462243405912418
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E062
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=pd3CufmI1QWuVt5

43 B
727 B

45ms
45ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=pd3CufmI1QWuVt5
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U1Wt4XsoYcWbnDuOS4hwdQG4g6qqLpe4PEN832wGsHeYEzD8mxUKjUwYMvPR1imDAAEzvnulods7s7fmCzgQNCKIeeiXBfGmAPijiDt8toY4jVFuZ31E9C54eyhzoQZfaKUUSEWtgzV%2BJA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3ac60a5c904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 27 Oct 2023 22:03:31 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-791-gff05a1f#rel-ec2-master i-0273dffb27b62012f@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=pd3CufmI1QWuVt5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame E062
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZTwzsQAACwH_FAAg

43 B
737 B

26ms
25ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZTwzsQAACwH_FAAg
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pkOMwyczrUuk1rCb3uxROjfad7%2BAEgfGgzjp3ZkmA%2FXDyquGcPicY%2BdrPzW0BRxqrAnyCkKWDT%2BSNzOCVvPvDfdnuynpMvyjnYp%2F5W2w88RLw1x3juiONrM0BYZ0aHT%2B0bFW5mdTktUyQg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3ac5fa4c904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

x-served-by: cache-fra-eddf8230042-FRA
pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1698444212.792034,VS0,VE0
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZTwzsQAACwH_FAAg
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E062
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=2079
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5124322329214744540

43 B
729 B

20ms
19ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5124322329214744540
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G2xgAoYbrSp4gBM7sY3G9hOXNbG5WAh6qfI5vZVRNO0iLlsAkxImj7LsT7t%2FFzwt93BkER3mooGsNybqzTV0JZy35NpsFGG%2F1Vp1O03LpQE8QI2e4e84H2VXjUTnbYIP82wiZ1RiLJh0Cg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3ac5fa4d904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=5124322329214744540
Date: Fri, 27 Oct 2023 22:03:31 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame E062
Redirect Chain

https://cm.ctnsnet.com/int/cm?exc=19
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=aa3f65c769374df89b1ce0ac593ef81a&expiration=1701036211

43 B
729 B

26ms
25ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=aa3f65c769374df89b1ce0ac593ef81a&expiration=1701036211
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AS3fsrGZtknuSu3qLRWGs4M8XWNmdV4a8Uz54xdG3wRKP9elrUStG7HsqHiTMTeYHwS5d5ZLTinUifvh5%2FztkBhEdGJzm99uQdegXorjW9rYEphP1sWL3RShjuEMUw1ORNOogsGSpj9m1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81ce3ac5fa4f904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=aa3f65c769374df89b1ce0ac593ef81a&expiration=1701036211
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame E062 43 B
152 B 20ms
19ms Image
image/gif 172.64.149.180
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?ZTwzr3PgpIElCasoWgOXSQAA%263343
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.dailyfaceoff.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.149.180 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:31 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 401
etag: "da1f1d-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 81ce3ac3ba3f6adc-FRA
content-length: 43
expires: Sat, 28 Oct 2023 22:03:31 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5ECD 0
0 53ms
53ms Fetch
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CwxzvrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBOACT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrFqARgRbwIPzWlcPTwBi5IZ--Afyzw9wD0yT0IdQnEaRNihV591x3cjVjRjLAtC-wCi5uiceionCFUzcmitfYmCVsON9bN9ciyWh3lSelbUQvty1lpeSReS_2nfRGppkvoybq2QV9LhgUheKtsZZse2yQFzuXfD6TlSnVDoYKoaJUHhgr-mfp_QMLTamAulAK7UNND83kapavKXjvMw875TKtGLR4c1tlQSlKTjK3269UJzjCad77G9Zyo1HnE4KcUCy5xuhoCF8uJsE6oLlQh8ULDVxyHkTGD88zWHdDNe0xXHv4Rhjw4HgmPtKeD76S9wWn0F548IkuHHLkJQLrlMmJ_Qj9Fi2y9aUc61LgqMAE992wssoE4AQBiAXfzLT3TJIFEwgSEAUYDzCoi7O73eXonegBUAGgBlSAB6OzxYwEqAfZtrECqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBDU216oCAHSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0zMzIyMDQxOTE3Nzc3OTk2mglpaHR0cHM6Ly93d3cuYXVkaWJsZS5kZS9jYXQvS3JpbWlzLVRocmlsbGVyLUhvZXJidWVjaGVyLzE2MjA5OTEwMDMxP3NvdXJjZV9jb2RlPURBV1BQMzBEVFJJQUw0MzkwOTE5MjMwMDVSgAoDyAsB4g0TCOzjtt2dl4IDFWiLgwcd5HwEF7AT0tCOFcITBhij-_SsKdgTAtgUAdAVAZgWAagWAYAXAbIXHgocCAASFHB1Yi05Nzg1ODM1NDcyNjU3ODA1GK3XbQ&sigh=Ji6QuHWxV98&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&ase=2&nis=4&cid=CAQSOwDICaaNfoRUiwQZvmBqobFb2SR8NlSau9ToXz3PD2F8c2KxpmMZoyk_Oq8cjzg-ORee26kIqC30XyzGGAE&sdkv=h.3.599.0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H2

200

B30829935.378629896;dc_pre=CKm7rd-dl4IDFarVEQgdjhsKeA;dc_trk_aid=569609914;dc_trk_cid=202625982;ord=1230045539;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_t... Show response
ad.doubleclick.net/ddm/trackimp/N1884730.279382DBMGROUPM-XAXISLI/ Frame 5ECD
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N1884730.279382DBMGROUPM-XAXISLI/B30829935.378629896;dc_trk_aid=569609914;dc_trk_cid=202625982;ord=1230045539;dc_lat=;dc_rdid=;tag_for_child_directed_treatme...
https://ad.doubleclick.net/ddm/trackimp/N1884730.279382DBMGROUPM-XAXISLI/B30829935.378629896;dc_pre=CKm7rd-dl4IDFarVEQgdjhsKeA;dc_trk_aid=569609914;dc_trk_cid=202625982;ord=1230045539;dc_lat=;dc_rd...

42 B
349 B

30ms
29ms

Fetch
image/gif

142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/trackimp/N1884730.279382DBMGROUPM-XAXISLI/B30829935.378629896;dc_pre=CKm7rd-dl4IDFarVEQgdjhsKeA;dc_trk_aid=569609914;dc_trk_cid=202625982;ord=1230045539;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1?nis=4

Protocol

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N1884730.279382DBMGROUPM-XAXISLI/B30829935.378629896;dc_pre=CKm7rd-dl4IDFarVEQgdjhsKeA;dc_trk_aid=569609914;dc_trk_cid=202625982;ord=1230045539;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1?nis=4
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Oy6hyfNY.js Show response
tpc.googlesyndication.com/sodar/ Frame 5ECD 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Oy6hyfNY.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.599.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b2ea1c9f3587781b58285cf64279e67f6329a3924fb93f81529f1826e2f4d16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 21:07:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89764
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15406
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 25 Oct 2024 21:07:27 GMT

GET
H2 200 B29377387.361896605;dc_trk_aid=553026232;dc_trk_cid=188456240;dc_dbm_token=AD1EzRQAAAA6CjQKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhQI38y090yoAsSDqrYEsAKG3-_jA0A7EN3Ib8teY2yytf2C_oFikrNhCdA=;ord=16366...
ad.doubleclick.net/ddm/trackimp/N1884730.279382BIDMANAGER_DFASIT/ Frame 5ECD 42 B
568 B 121ms
25ms Image
image/gif 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N1884730.279382BIDMANAGER_DFASIT/B29377387.361896605;dc_trk_aid=553026232;dc_trk_cid=188456240;dc_dbm_token=AD1EzRQAAAA6CjQKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhQI38y090yoAsSDqrYEsAKG3-_jA0A7EN3Ib8teY2yytf2C_oFikrNhCdA=;ord=1636633556;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=;dc_tdv=1;dc_exteid=1110824260793765247;dc_av=66056;dc_sk=1;dc_ctype=84;dc_ref=;dc_pubid=3;dc_btype=23?gclid=EAIaIQobChMIpP233Z2XggMVaIuDBx3kfAQXEAEYASAAEgKmA_D_BwE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
64 B 48ms
47ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=C5vYBrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBNwCT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsXF8uP7zje5pBo7849i6-K8e7ogXxjf7We6_7uUCA5Yx9j9lUM2THyu271PekvpzGlBTaZ7dLP5_exLlwAT33bCyygTgBAGIBd_MtPdMoAZUgAejs8WMBKgH2baxAqgHjs4bqAeT2BuoB5zcG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAtgHAagIAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTMzMjIwNDE5MTc3Nzc5OTaACgPICwHaDBAKChCwnbKLta7cwDMSAgEDqg0CREXiDRMI7OO23Z2XggMVaIuDBx3kfAQXsBPS0I4V2BMC2BQB0BUBmBYBqBYB-BYBgBcB&sigh=tTTUkrSgqAo&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&label=vast_creativeview&ad_mt=0&sdkv=h.3.599.0&vci=CpgBCAESHnNlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldBoHQWRTZW5zZSAEKgw2MDgwNDY3NTIwNTIyDDY3NzMxNDQ4NzY5NEDEAlImEA8lAACgQSgBOgs2RHVqTGRkc3hhZ0IJZ29vZ2xlYWRzSLoYUABaImRvdWJsZWNsaWNrYnlnb29nbGUuY29tLW9taWQtdmlkZW8YAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview_ext
pagead2.googlesyndication.com/ Frame 5ECD 42 B
64 B 16ms
15ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/activeview_ext?id=lidarv&avm=1&dc_pubid=3&dc_exteid=1110824260793765247&acvw=sv%3D958%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D581,-2600,950,-1944%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D20015%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26ic%3D33554450%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1122%26femvt%3D0%26emc%3D5%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D61777526%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnk%3D1698444206785%26ptlt%3D1698444211761%26pngs%3D9,14,15%26veid%3Dsloi%3A1,ovms%3A1,xdi%3A0,amp%3A0,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1698444208182?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
64 B 46ms
45ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=C5vYBrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBNwCT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsXF8uP7zje5pBo7849i6-K8e7ogXxjf7We6_7uUCA5Yx9j9lUM2THyu271PekvpzGlBTaZ7dLP5_exLlwAT33bCyygTgBAGIBd_MtPdMoAZUgAejs8WMBKgH2baxAqgHjs4bqAeT2BuoB5zcG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAtgHAagIAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTMzMjIwNDE5MTc3Nzc5OTaACgPICwHaDBAKChCwnbKLta7cwDMSAgEDqg0CREXiDRMI7OO23Z2XggMVaIuDBx3kfAQXsBPS0I4V2BMC2BQB0BUBmBYBqBYB-BYBgBcB&sigh=tTTUkrSgqAo&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&label=part2viewed&ad_mt=0&sdkv=h.3.599.0&vci=CpgBCAESHnNlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldBoHQWRTZW5zZSAEKgw2MDgwNDY3NTIwNTIyDDY3NzMxNDQ4NzY5NEDEAlImEA8lAACgQSgBOgs2RHVqTGRkc3hhZ0IJZ29vZ2xlYWRzSLoYUABaImRvdWJsZWNsaWNrYnlnb29nbGUuY29tLW9taWQtdmlkZW8YAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=11;acvw=sv%3D958%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D581,-2600,950,-1944%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,...
ade.googlesyndication.com/ddm/activity_ext/ Frame 5ECD 42 B
401 B 141ms
43ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=11;acvw=sv%3D958%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D581,-2600,950,-1944%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D20015%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26i0%3D33554450%26ic%3D0%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1122%26femvt%3D0%26emc%3D5%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D61777526%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnk%3D1698444206785%26ptlt%3D1698444211762%26pngs%3D9,14,15s%26veid%3Dsloi%3A1,ovms%3A1,xdi%3A0,amp%3A0,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1698444208182?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
64 B 47ms
46ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=C5vYBrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBNwCT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsXF8uP7zje5pBo7849i6-K8e7ogXxjf7We6_7uUCA5Yx9j9lUM2THyu271PekvpzGlBTaZ7dLP5_exLlwAT33bCyygTgBAGIBd_MtPdMoAZUgAejs8WMBKgH2baxAqgHjs4bqAeT2BuoB5zcG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAtgHAagIAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTMzMjIwNDE5MTc3Nzc5OTaACgPICwHaDBAKChCwnbKLta7cwDMSAgEDqg0CREXiDRMI7OO23Z2XggMVaIuDBx3kfAQXsBPS0I4V2BMC2BQB0BUBmBYBqBYB-BYBgBcB&sigh=tTTUkrSgqAo&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&label=admute&ad_mt=0&sdkv=h.3.599.0&vci=CpgBCAESHnNlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldBoHQWRTZW5zZSAEKgw2MDgwNDY3NTIwNTIyDDY3NzMxNDQ4NzY5NEDEAlImEA8lAACgQSgBOgs2RHVqTGRkc3hhZ0IJZ29vZ2xlYWRzSLoYUABaImRvdWJsZWNsaWNrYnlnb29nbGUuY29tLW9taWQtdmlkZW8YAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=16;acvw=sv%3D958%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D581,-2600,950,-1944%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0...
ade.googlesyndication.com/ddm/activity_ext/ Frame 5ECD 42 B
107 B 142ms
44ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=16;acvw=sv%3D958%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D581,-2600,950,-1944%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D442%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D442%26pst%3D-1%26dur%3D20015%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D442%26is%3D33554450%26i0%3D33554450%26ic%3D4096%26cs%3D33558546%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1122%26femvt%3D0%26emc%3D5%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D61777526%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnk%3D1698444206785%26ptlt%3D1698444211766%26pngs%3D9,14,15s%26veid%3Dsloi%3A1,ovms%3A1,xdi%3A0,amp%3A0,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1698444208182?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 3D52 0
260 B 125ms
21ms Script
text/plain 185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=159835&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:32 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 3D52 2 KB
2 KB 21ms
20ms Script
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=4563702&p=159835&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 6b82cf647adadca17e7bff6a803d9a34f1918256c2d8625a5461c639c4468591

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 27 Oct 2023 22:03:30 GMT
content-length: 1661
content-type: text/html; charset=UTF-8

GET
H2 200 liveView.php
live.primis.tech/live/ 0
419 B 30ms
30ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTAzp2VlqzVlVGygZT0kNwx4NDQ0MwA1JaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTY2MDMkMwYzrD02NTYzrT0mNwxzoXN0YT0kNmI1NTU0MCZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzqzyxX2F0nT1zqXRvo2kmnXRyplZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMmMxQmMTMjMxQmMwM4NUYmMDMkN0Q3QwpmMmEmNmMlMmUmNTM1MmQmMDqEN0I0MmM1Mmp3RDqCNTM2NDMmNwQmMmRDNxQ1MwY4NwE1Nmp4MmU1QTZENDY2QTVBNTpmOTZENUE2OTM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwM0MmA3RDqCNTxmNDM0MmA3RDqCNwYmMTqEN0I0QmMkMmpmMmMlMmY3REZFRxUzZGyunWQ9JaVmZXJJpEFxZHI9MwAjMSUmQWFwOCUmQTIjJTNBM2EjMCUmQTEjMTIyM0FxNWUjJTNBYTIjZvUmQTY3NTMzqXNypyVBPU1irzyfoGEyMxY1LwAyMwAyMwuXnW5xo3qmJTIjTyQyMwAkMC4jJTNCJTIjV2yhNwQyM0IyMwB4NwQyMwxyMwBBpHBfZVqyYxgcqCUlRwUmNl4mNvUlMCUlOEgIVE1MJTJDJTIjoGyeZSUlMEqyY2giJTI5JTIjQ2ulo21yJTJGMTE4LwAhNTx5Ml4kMTpyMwBTYWZupzxyMxY1MmphMmYzY3N1qWyxPTY1M2MmM2FwYwY4ODpzpaZhPTIlMTAzY29hqGVhqEZcoGVJZD0mNmtkODxmJz1yZGyuUGkurUkcp3RJZD0kNDEjNvZgZWRcYUkcp3RJZD0mNTplNvZcp0V4Y2k1ZGVGpz9gT3B0PTAznXNDYWNbZWRCnWQ9MCZwo250ZW50TWF0Y2uUrXByPSZmp3BsYWRioT0zpGkuY2VgZW50U3RlZWFgVHyjZT0kJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMTIkNwpzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD0lMTE5MDpkODI1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: ebiQFX4oZvDDY29to09L--Xzd2AhocPrtv39gnJh1EEZ8dl09RrZzg==

GET
H2 200 liveView.php
live.primis.tech/live/ 0
420 B 26ms
25ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTpzp2VlqzVlVGygZT0kNwx4NDQ0MwA1JaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTY2MDMkMwYzrD02NTYzrT0mNwxzoXN0YT0kNmI1NTU0MCZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzqzyxX2F0nT1zqXRvo2kmnXRyplZ1p2VlSXBBZGRlPTIjMDEyM0FuYmtyM0ElMCUmQTNuMDAyM0EkMDElJTNBZDVyMCUmQWElMGYyM0E2NmUmJaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwEkOC4jLwU5OTMhMTE3JTIjU2FzYXJcJTJGNTM3LwM2JzNmqXVcZD02NTNwMmNuY2I2ODt3JaJ2ow0lMwEjJzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMTIkNmUzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD0kNwtmNwp0NTx=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:31 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: U6Tm0pUuqjmfa95jYySwYdaJ6Ugl8pK7pM-xGIdOwIoeJWMukHknsg==

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 5103 0
595 B 22ms
18ms Script
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:32 GMT
an-x-request-uuid: 2be475be-112c-4856-ae82-d6555dc8ae75
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 25C3 0
595 B 23ms
21ms Script
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

static.2.86.88.23.clients.your-server.de

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:32 GMT
an-x-request-uuid: 2b8fae61-2ece-405f-91b2-d34e473e1b54
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 24ms
23ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-WYFDLPLCRR&gtm=45je3ap0v894180707&_p=1222580907&gcd=11l1l1l1l1&cid=137208439.1698444205&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEI&_s=2&sid=1698444204&sct=1&seg=0&dl=https%3A%2F%2Fwww.dailyfaceoff.com%2F&dt=Starting%20Goalies%2C%20Line%20Combinations%2C%20NHL%20News%2C%20Opinion%2C%20and%20Analysis%20-%20Daily%20Faceoff&en=ad_impression&ep.query_id=CLPR5dydl4IDFQfXuwgd4yMGzA&_et=1933
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-WYFDLPLCRR&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 playback
www.youtube.com/api/stats/ Frame 5ECD 0
0 49ms
14ms Image
text/html 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/api/stats/playback?ns=yt&fexp=44772139%2C44777649%2C44781409%2C44802463%2C44806075&el=adunit&cpn=rynfzjBT0iMi9O1-&docid=6DujLddsxag&visitordata=CgtuNC04LXFmVmlNaw%253D%253D&of=-_xhI4eL4MjOL53E0nwGhA&ver=2&cmt=1.306&fmt=18&rt=0.000&adformat=2_2_1&euri=https%3A%2F%2Fwww.dailyfaceoff.com%2F&len=20.016&vtype=gvp&c=web_gvp_ads&cver=h.0.0.0&cbr=Chrome&cbrver=118.0.5993.117&cos=Win32&cosver=537.36&cplatform=desktop&mos=1&volume=0&delay=18&rtn=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H2 200 chunklist_480.m3u8 Show response
video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/ 707 B
1 KB 65ms
21ms XHR
application/vnd.apple.mpegurl 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/chunklist_480.m3u8
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 591d804fde68bca3eb9c2890ca13269d32e69b934015c835c58bf3fbcbc0882a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 11:06:49 GMT
via: 1.1 64269b4eda1211bca4d40d7ab2177910.cloudfront.net (CloudFront), 1.1 1872df29670137f21773bdb80da38e36.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1, LHR50-P3
age: 39404
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 707
last-modified: Fri, 27 Oct 2023 04:25:00 GMT
server: nginx
etag: "16dedd9843ebf0f8b6bc64ecaf782f56"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cache-control: max-age=86400
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: 1IFqF0NW5JVS1maIef3Dcntraxcgq5oEbRvU8HzuWd5tGveo_csEJA==
expires: Sat, 28 Oct 2023 11:06:49 GMT

GET
H3 200 hhrtBw21.html Show response
tpc.googlesyndication.com/sodar/ Frame 37BC 23 KB
9 KB 7ms
7ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/hhrtBw21.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Oy6hyfNY.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

861aed070db50ce0da9928455deff784c115b44540b09450f225ff7cff0c7429

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 49788
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8727
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 08:13:45 GMT
expires: Sat, 26 Oct 2024 08:13:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 liveView.php
live.primis.tech/live/ 0
420 B 21ms
21ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTI1JaNypaZypyRcoWU9MTY5ODQ0NDIjNCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTEmNwp4JaN0YT0jJat9NwQjJax9NDQjJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzp2Reqw0zqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZxqXI9ODQjJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMTM5OTYzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD0kNTQ2MwY5OTUl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:33 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: xIX3-Nx3bcmv96WTJfOsVmRuf4gL8ilVmeSwrsH9_hUEMNeQNai4jw==

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame FAAB 35 B
600 B 32ms
31ms Document
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=B25261B6-EDE2-464E-8639-81237415D144&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Fri, 27 Oct 2023 22:03:34 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame E212
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
422 B

179ms
165ms

Document
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 81ce3ad2e9385d7a-FRA
content-length: 43
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:34 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 81ce3ad1c82c5d7a-FRA
content-type: text/html
date: Fri, 27 Oct 2023 22:03:34 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 373

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 998C 0
0

GET
H/1.1 204
No Content pub
matching.truffle.bid/sync/ Frame 202D 0
0 45ms
9ms Document
text/plain 23.88.86.2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.88.86.2 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

nginx/1.23.1 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Date: Fri, 27 Oct 2023 22:03:34 GMT
Server: nginx/1.23.1
Strict-Transport-Security: max-age=15768000

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 927C
Redirect Chain

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:4FC39DCB3D064A649B7E8557A4C3A953&gdpr=0&gdpr_consent=

1 B
53 B

15ms
14ms

Document
text/html

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:4FC39DCB3D064A649B7E8557A4C3A953&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Fri, 27 Oct 2023 22:03:32 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-length: 142
content-type: text/html
date: Fri, 27 Oct 2023 22:03:34 GMT
expires: Thu, 26 Oct 2023 22:03:34 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:4FC39DCB3D064A649B7E8557A4C3A953&gdpr=0&gdpr_consent=
server: openresty
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C07E
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/pubmatic?zcc=1&cb=1698444214060
https://ad.turn.com/r/cs?pid=45&rndcb=1552421305
https://sync.1rx.io/usersync/turn/4294739934230002354?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-7fce20dc-2c10-457e-9a01-fe8e7009987b-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-7fce20dc-2c10-457e-9a01-fe8e7009987b-003

42 B
333 B

14ms
14ms

Document
image/gif

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-7fce20dc-2c10-457e-9a01-fe8e7009987b-003
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-type: text/html
date: Fri, 27 Oct 2023 22:03:34 GMT
etag: RX7fce20dc2c10457e9a01fe8e7009987b003
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-7fce20dc-2c10-457e-9a01-fe8e7009987b-003
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

GET
H2 200 mw
mwzeom.zeotap.com/ Frame 3D52 95 B
439 B 56ms
24ms Image
image/png 2606:4700:10::6816:1957
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&gdpr=0&gdpr_consent=&cid=B25261B6-EDE2-464E-8639-81237415D144

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:34 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains; preload
vary: Origin
content-type: image/png
access-control-allow-origin: https://ads.pubmatic.com
access-control-allow-credentials: true
cf-ray: 81ce3ad1cc950493-FRA
access-control-allow-headers: *
content-length: 95

GET
H/1.1

200
OK

info2
uipglob.semasio.net/pubmatic/1/ Frame 3D52
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=B25261B6-EDE2-464E-8639-81237415D144&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=B25261B6-EDE2-464E-8639-81237415D144&sInitiator=external&gdpr=0&gdpr_consent=

42 B
603 B

33ms
33ms

Image
image/gif

77.243.51.121
NETIC-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=B25261B6-EDE2-464E-8639-81237415D144&sInitiator=external&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 77.243.51.121 , Denmark, ASN42697 (NETIC-AS, DK),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:46 GMT
frontend-id: 8
p3p: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
content-type: image/gif
uip-response-status: Ok
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-origin: *
content-length: 42
routing-server-id: -1
expires: Sat, 01 Jan 2011 12:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:45 GMT
frontend-id: 12
p3p: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
location: /pubmatic/1/info2?sType=sync&sExtCookieId=B25261B6-EDE2-464E-8639-81237415D144&sInitiator=external&gdpr=0&gdpr_consent=
uip-response-status: Ok
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-origin: *
content-length: 0
routing-server-id: -1
expires: Sat, 01 Jan 2011 12:00:00 GMT

GET
H2

200

52799
stags.bluekai.com/site/ Frame 3D52
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=B25261B6-EDE2-464E-8639-81237415D144&gdpr=0&gdpr_consent=
https://pixel.onaudience.com/?partner=282&icm&cver&gdpr=0&smartmap=1&redirect=stags.bluekai.com%2Fsite%2F52799%3Fid%3D%25m
https://stags.bluekai.com/site/52799?id=6d76c542e1871a3f

62 B
218 B

230ms
161ms

Image
image/gif

2.23.197.190
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/52799?id=6d76c542e1871a3f
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Server: 2.23.197.190 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-197-190.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Fri, 27 Oct 2023 22:03:34 GMT
content-length: 62
content-type: image/gif

Redirect headers

location: https://stags.bluekai.com/site/52799?id=6d76c542e1871a3f
content-length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 3D52
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8287462243405912418

42 B
95 B

15ms
14ms

Image
image/gif

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8287462243405912418
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 27 Oct 2023 22:03:33 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:34 GMT
an-x-request-uuid: 7cb14726-da4c-4353-b122-8b11e4fe83c3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8287462243405912418
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
421 B 21ms
20ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTQlJaNypaZypyRcoWU9MTY5ODQ0NDIjNCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTEmNwp4JaN0YT0jJat9NwQjJax9NDQjJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzp2Reqw0zqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZxqXI9ODI5JzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMTQjMwYzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD01MwI3OTMlMmE=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:33 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: vG849F-K7UEuzfrLkUPvLItqCpUfHpr3ya9Hf8AHXf-L38B-Dty5TA==

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame F5B0 47 B
227 B 20ms
20ms Script
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=23372256&p=159835&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 09343d3b3473e1c994b2d603c99feb8a0f63fbd3ff20be7432ff18b973dbe651

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 27 Oct 2023 22:03:33 GMT
content-length: 47
content-type: text/html; charset=UTF-8

GET
H2 200 w_480_00000.ts Show response
video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/ 257 KB
258 KB 27ms
27ms XHR
video/mp2t 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/w_480_00000.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: adc7b78ad3e891ff65e5f879e620b87323a1eb02daa64084d76c3f5d626184cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 06:16:58 GMT
via: 1.1 4c18e6ed879a674305cb5156731cf396.cloudfront.net (CloudFront), 1.1 1872df29670137f21773bdb80da38e36.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1, LHR50-P3
age: 56795
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 262824
last-modified: Fri, 27 Oct 2023 04:25:00 GMT
server: nginx
etag: "1f1de934167ad5072d2d8bd62683f3f5"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: 45TZfWtoNVsdkCm_DSiME32QZH6yiseRBl7FNcdGCIhql_ZEexFS8w==
expires: Fri, 10 Nov 2023 06:16:58 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
420 B 21ms
21ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTEmJaNypaZypyRcoWU9MTY5ODQ0NDIjNSZ2nWRspGkurWVlVzVlPTMhMS4jJaM9NTtjNTpzp3RuPTE2NwAmMTI2Jat9NwU2Jax9MmY5Jz1mqGE9MTplNTU1NDAzqzyxX3Zup3RUrXByPTMzqzyxX3ZcZXquYzyfnXR5U3RuqGU9MSZ2nWRspGFmp0RioWFcow13q3phZGFcoHyzYWNyo2ZzLzNioSZmqWJJZD13q3phZGFcoHyzYWNyo2ZzLzNioSZxZWJ1Z0yhZz9loWF0nW9hPSZcp0FjpD0jJaZcZF9uqGx9ZaV0Yz9fp2y0ZXMzqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZlqz49MwIkMCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZmp3BsYWRioT0zpGkuY2VgZW50U3RlZWFgVHyjZT0kJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMTQ2NDxzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD0kMmYkMmt2MmU3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:34 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: OGVYQ1G8GHeuuyfkyq5zKmt2kfEsw1Sww0jIEjOR-JB5jfp8j3l2sA==

GET
BLOB 200
OK 5ea84e9a-3a15-46d8-a9a9-bad9e4760b5f
https://www.dailyfaceoff.com/ 67 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.dailyfaceoff.com/5ea84e9a-3a15-46d8-a9a9-bad9e4760b5f
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3e57eb372e8b405c816875571e184854b2846261c7477c6c9bdb7782faa1a30

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Length: 68465
Content-Type: text/javascript

GET
H3 200 mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js Show response
pagead2.googlesyndication.com/bg/ Frame 37BC 38 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/hhrtBw21.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99235240097ffe1c3ccf93f0275840df66a62f6ce406788402b06df413755d67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 11:45:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15010
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 26 Oct 2024 11:45:42 GMT

GET
H3 200 activeview_ext
pagead2.googlesyndication.com/ Frame 5ECD 42 B
64 B 15ms
15ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/activeview_ext?id=lidarv&dc_pubid=3&dc_exteid=1110824260793765247&acvw=sv%3D958%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D581,400,950,1056%26tos%3D2514,0,0,0,0%26mtos%3D2514,2514,2514,2514,2514%26amtos%3D0,0,0,0,0%26mcvt%3D2514%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D4551%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1230%26pst%3D2037%26dur%3D20015%26vmtime%3D4667%26dtos%3D2514%26dtoss%3D1%26dvs%3D2514%26dfvs%3D2514%26dvpt%3D4109%26is%3D33554707%26i0%3D33554450%26ic%3D16777473%26cs%3D50336019%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1122%26femvt%3D0%26emc%3D11%26emuc%3D0%26emb%3D5,0,0,0,0%26avms%3Dexc%26qi%3D61777526%26psm%3D-2147483618%26psv%3D30%26psfv%3D30%26psa%3D0%26pnk%3D1698444206785%26ptlt%3D1698444215876%26pngs%3D9,14,15s%26veid%3Dsloi%3A1,ovms%3A1,xdi%3A0,amp%3A0,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,2514,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.12%26t%3D1698444208182?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 3D52 0
128 B 23ms
22ms Script
text/plain 185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=159835&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159835&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 22:03:35 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
64 B 46ms
45ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=C5vYBrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBNwCT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsXF8uP7zje5pBo7849i6-K8e7ogXxjf7We6_7uUCA5Yx9j9lUM2THyu271PekvpzGlBTaZ7dLP5_exLlwAT33bCyygTgBAGIBd_MtPdMoAZUgAejs8WMBKgH2baxAqgHjs4bqAeT2BuoB5zcG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAtgHAagIAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTMzMjIwNDE5MTc3Nzc5OTaACgPICwHaDBAKChCwnbKLta7cwDMSAgEDqg0CREXiDRMI7OO23Z2XggMVaIuDBx3kfAQXsBPS0I4V2BMC2BQB0BUBmBYBqBYB-BYBgBcB&sigh=tTTUkrSgqAo&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&label=videoplaytime25&ad_mt=5330&sdkv=h.3.599.0&vci=CpgBCAESHnNlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldBoHQWRTZW5zZSAEKgw2MDgwNDY3NTIwNTIyDDY3NzMxNDQ4NzY5NEDEAlImEA8lAACgQSgBOgs2RHVqTGRkc3hhZ0IJZ29vZ2xlYWRzSLoYUABaImRvdWJsZWNsaWNrYnlnb29nbGUuY29tLW9taWQtdmlkZW8YAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=960584;acvw=sv%3D958%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D581,400,950,1056%26tos%3D3134,0,0,0,0%26mtos%3D3134,3134,3134,313...
ade.googlesyndication.com/ddm/activity_ext/ Frame 5ECD 42 B
107 B 45ms
44ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=960584;acvw=sv%3D958%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D581,400,950,1056%26tos%3D3134,0,0,0,0%26mtos%3D3134,3134,3134,3134,3134%26amtos%3D0,0,0,0,0%26mcvt%3D3134%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D5171%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1849%26pst%3D2037%26dur%3D20015%26vmtime%3D5329%26dtos%3D620%26dtoss%3D2%26dvs%3D620%26dfvs%3D620%26dvpt%3D620%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26ic%3D0%26cs%3D50336019%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D3134,3134,3134,3134,3134%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D0%26ces%26femt%3D1122%26femvt%3D0%26emc%3D12%26emuc%3D0%26emb%3D6,0,0,0,0%26avms%3Dexc%26qi%3D61777526%26psm%3D-2147483586%26psv%3D62%26psfv%3D62%26psa%3D0%26pnk%3D1698444206785%26ptlt%3D1698444216496%26pngs%3D9s,14,15s%26veid%3Dsloi%3A1,ovms%3A1,xdi%3A0,amp%3A0,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,3134,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.12%26t%3D1698444208182?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
64 B 47ms
46ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=C5vYBrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBNwCT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsXF8uP7zje5pBo7849i6-K8e7ogXxjf7We6_7uUCA5Yx9j9lUM2THyu271PekvpzGlBTaZ7dLP5_exLlwAT33bCyygTgBAGIBd_MtPdMoAZUgAejs8WMBKgH2baxAqgHjs4bqAeT2BuoB5zcG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAtgHAagIAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTMzMjIwNDE5MTc3Nzc5OTaACgPICwHaDBAKChCwnbKLta7cwDMSAgEDqg0CREXiDRMI7OO23Z2XggMVaIuDBx3kfAQXsBPS0I4V2BMC2BQB0BUBmBYBqBYB-BYBgBcB&sigh=tTTUkrSgqAo&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&label=video_skip_shown&ad_mt=5330&sdkv=h.3.599.0&vci=CpgBCAESHnNlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldBoHQWRTZW5zZSAEKgw2MDgwNDY3NTIwNTIyDDY3NzMxNDQ4NzY5NEDEAlImEA8lAACgQSgBOgs2RHVqTGRkc3hhZ0IJZ29vZ2xlYWRzSLoYUABaImRvdWJsZWNsaWNrYnlnb29nbGUuY29tLW9taWQtdmlkZW8YAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 ingest.php
events.newsroom.bi/ 2 B
780 B 20ms
19ms Ping
application/json 162.19.56.86
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://events.newsroom.bi/ingest.php
Requested by: Host: sdk.mrf.io
URL: https://sdk.mrf.io/statics/marfeel-sdk.js?id=294
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.19.56.86 , France, ASN16276 (OVH, FR),
Reverse DNS: haproxy01.cl13.ovh.mrf.io
Software: istio-envoy /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 27 Oct 2023 22:03:37 GMT
server: istio-envoy
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-expose-headers: Content-Length,Content-Range
cache-control: private,no-store
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 2

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 37BC 0
20 B 50ms
50ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=36&t=2&li=v_h.3.599.0&bgai=BvNO6rzM8ZeTpM-iWjuwP5PmRuAEAAAAAOAG6BRMI_Ie23Z2XggMV1IiDBx0c-AYH&bg=!BQalBknNAAbo5yKYyOc7ADQBe5WfOBlF48mN1Yx3yA0tPHelELH7YNXO9_sqWEA3Mu8UDqDmfu_hjCNOL3TBXMOKePkQAgAACgVSAAAAAmgBBwoBRLzV5KHHT8CWOjSEwcDSuHmPEZeAqiluuw264uGybMEp9poogTfHLb1XO4y0UKDsznCIA_ILp3lpqI0bbeuBTgi61DP0Y_3Y--HofN-7JBAQGK8hXBPIFa2dyXw8I3ze5VQ-zuFOPnB4zop2ZNDjAOQ6HxkCVxMWAOWK_usj7S5qV4NAb9cNNLxTrUCedQrSJ52NsaPjDzs6ToKMFO62Vg2htOGbscx8UgZzLmWM-SWpN-8m2xJ4CU_YMpJHl8jvA6-Y0blktcRt1IVCOk5-IkIW4nuZA6_OA3yfXvElE0BPzcfFDWwljy4PFDle3yTZt0jpc-SaAEFTj1K3hsjoG_0IQUtG4_E3waJTv7XVNfIAONXwgt3nlemAbpPBcmsLERUew92bHMTiV9nW5nzM4M5PZTd9L_4YWYFO7IRwXaSLsmiRm5kCP-mPvsMNTvTj6_JkS3VVxNPU0UzghXZoMdLjp9f-ga8hUZscFHftSCIDsz6VFBhOuBHk9NZa6MtK8Y8H7uYns87jgQe0oUjdF791mNedkbB05amPTDzXU-KRCpnqw1F4TRPQHFPPZliMcfuU7VsS9NXYIJJdfcwXKAqkxIwBgypuzgcjWlje57klNQ1UDsd4hDxjIcLULTllLa0JiB13GhvaxaDjxweDpBoHlI2Jc1sMXoDg2zJYeDjAV8nRd4SEs7HAnY8oW9VqUAxRWaJOsPjhxDQLvatDmDbuvujxA0txs_z0sAzL5O3Ku7Qhv4x3FV_a0hD5whSAJ2DXaEkt3zhx5zdx5YeIBboAVQ0-sGl_H7cZELOZgQzsIy4P69ahWpUm8mTZeB1zUKs9rdf4D4FbnpoD79PfuJwu1h7j3WFpfwb81_rOhY-t2ZHPBKcWpJKLP1JexDvkxEgc_Cx-7W8GDF9uHHX5u3hND0IWmATkt5FblF3OK3ENQv-J2iIzUfsKO5dTafk-tkswHYBO7VsZfs1GaBNCDlGvGPzUfiTqjN6gF4WHfkFPCu4BtDspMejb1fUOyVQYqT7m62uEFl5DmX4Krs5LbxQmYprQ6DmzMAsLfdHpEW5CBe0saN6tqaTGzrhsdiOGPY01rjrqOrLjnLNeyujKG6T3flwck4PlpVltbt84Lq6Fjl4mtI0Ljux8VFl094rKPMgRjrARoKeyLe0TX6AY81SG25Ul8BwoWxEBDZ9Xh42P_UT0DrXh

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 w_480_00001.ts Show response
video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/ 190 KB
191 KB 25ms
24ms XHR
video/mp2t 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/w_480_00001.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b6a60b3665380654749d0d620b22d301d4a4d8ad740a41b3973e87f4b4020b43

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 06:16:58 GMT
via: 1.1 c67ae9899d89f9402837da3a0ead9442.cloudfront.net (CloudFront), 1.1 1872df29670137f21773bdb80da38e36.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1, LHR50-P3
age: 56801
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 194956
last-modified: Fri, 27 Oct 2023 04:25:00 GMT
server: nginx
etag: "6f9403d7a4edb76eaef1625b3ba11120"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: Rcn7wgPeh18lCJzNCg_T82ZIGex_xmkyw5MMX5gyIbncBjt-sDqjug==
expires: Fri, 10 Nov 2023 06:16:58 GMT

GET
H2

204

aclk
www.googleadservices.com/pagead/ Frame 5ECD
Redirect Chain

https://googleads.g.doubleclick.net/aclk?sa=l&ai=CvF7jrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHij...
https://www.googleadservices.com/pagead/aclk?sa=L&ai=Ci42MrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECW...

0
0

46ms
17ms

Fetch
text/html

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.googleadservices.com/pagead/aclk?sa=L&ai=Ci42MrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsSl9GuL7t3hblF8KY6RdeMK0drm6XnMuzc9pUtAmCTU73yen202ispFFwn3GJQ7_O4bl_7DxNC28424Cpn1lwAT33bCyygTgBAGIBd_MtPdMkgUICAMQAhgBUAHABW6gBlSAB6OzxYwEqAfZtrECqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcBqAgB0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tMzMyMjA0MTkxNzc3Nzk5NpoJQmh0dHBzOi8vd3d3LmF1ZGlibGUuZGUvY2F0L0tyaW1pcy1UaHJpbGxlci1Ib2VyYnVlY2hlci8xNjIwOTkxMDAzMbEJWpn5y51i6uaACgPICwHQCw_gCwHaDBAKChCwnbKLta7cwDMSAgEDmg0BD6oNAkRFyA0B4g0TCOzjtt2dl4IDFWiLgwcd5HwEF7AT0tCOFdgTAtgUAdAVAZgWAagWAfgWAYAXAQ&ase=2&gclid=EAIaIQobChMIpP233Z2XggMVaIuDBx3kfAQXEAEYASAAEgKmA_D_BwE&num=1&cid=CAQSOwDICaaNfoRUiwQZvmBqobFb2SR8NlSau9ToXz3PD2F8c2KxpmMZoyk_Oq8cjzg-ORee26kIqC30XyzGGAE&client=ca-video-pub-1320774679920841&ctype=110&label=video_10s_engaged_view&ad_mt=10225&nis=5&dblrd=1&sig=AOD64_30vVGKpi7dmm4ZeVDRRl-1GofRzQ&adurl=https://ad.doubleclick.net/ddm/trackclk/N1884730.279382DBMGROUPM-XAXISLI/B30829935.378629896%3Bdc_trk_aid%3D569609914%3Bdc_trk_cid%3D202625982%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bltd%3D%3Bdc_tdv%3D1
Protocol: H2
Server: 142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:41 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
server: adclick_server
p3p: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/aclk?sa=L&ai=Ci42MrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsSl9GuL7t3hblF8KY6RdeMK0drm6XnMuzc9pUtAmCTU73yen202ispFFwn3GJQ7_O4bl_7DxNC28424Cpn1lwAT33bCyygTgBAGIBd_MtPdMkgUICAMQAhgBUAHABW6gBlSAB6OzxYwEqAfZtrECqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcBqAgB0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tMzMyMjA0MTkxNzc3Nzk5NpoJQmh0dHBzOi8vd3d3LmF1ZGlibGUuZGUvY2F0L0tyaW1pcy1UaHJpbGxlci1Ib2VyYnVlY2hlci8xNjIwOTkxMDAzMbEJWpn5y51i6uaACgPICwHQCw_gCwHaDBAKChCwnbKLta7cwDMSAgEDmg0BD6oNAkRFyA0B4g0TCOzjtt2dl4IDFWiLgwcd5HwEF7AT0tCOFdgTAtgUAdAVAZgWAagWAfgWAYAXAQ&ase=2&gclid=EAIaIQobChMIpP233Z2XggMVaIuDBx3kfAQXEAEYASAAEgKmA_D_BwE&num=1&cid=CAQSOwDICaaNfoRUiwQZvmBqobFb2SR8NlSau9ToXz3PD2F8c2KxpmMZoyk_Oq8cjzg-ORee26kIqC30XyzGGAE&client=ca-video-pub-1320774679920841&ctype=110&label=video_10s_engaged_view&ad_mt=10225&nis=5&dblrd=1&sig=AOD64_30vVGKpi7dmm4ZeVDRRl-1GofRzQ&adurl=https://ad.doubleclick.net/ddm/trackclk/N1884730.279382DBMGROUPM-XAXISLI/B30829935.378629896%3Bdc_trk_aid%3D569609914%3Bdc_trk_cid%3D202625982%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bltd%3D%3Bdc_tdv%3D1
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
64 B 45ms
45ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=C5vYBrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBNwCT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsXF8uP7zje5pBo7849i6-K8e7ogXxjf7We6_7uUCA5Yx9j9lUM2THyu271PekvpzGlBTaZ7dLP5_exLlwAT33bCyygTgBAGIBd_MtPdMoAZUgAejs8WMBKgH2baxAqgHjs4bqAeT2BuoB5zcG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAtgHAagIAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTMzMjIwNDE5MTc3Nzc5OTaACgPICwHaDBAKChCwnbKLta7cwDMSAgEDqg0CREXiDRMI7OO23Z2XggMVaIuDBx3kfAQXsBPS0I4V2BMC2BQB0BUBmBYBqBYB-BYBgBcB&sigh=tTTUkrSgqAo&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&label=videoplaytime50&ad_mt=10225&sdkv=h.3.599.0&vci=CpgBCAESHnNlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldBoHQWRTZW5zZSAEKgw2MDgwNDY3NTIwNTIyDDY3NzMxNDQ4NzY5NEDEAlImEA8lAACgQSgBOgs2RHVqTGRkc3hhZ0IJZ29vZ2xlYWRzSLoYUABaImRvdWJsZWNsaWNrYnlnb29nbGUuY29tLW9taWQtdmlkZW8YAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=18;acvw=sv%3D958%26cb%3Dima%26e%3D2%26nas%3D1%26sdk%3Dh%26p%3D581,400,950,1056%26tos%3D7726,0,0,0,0%26mtos%3D7726,7726,7726,7726,77...
ade.googlesyndication.com/ddm/activity_ext/ Frame 5ECD 42 B
63 B 44ms
43ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=18;acvw=sv%3D958%26cb%3Dima%26e%3D2%26nas%3D1%26sdk%3Dh%26p%3D581,400,950,1056%26tos%3D7726,0,0,0,0%26mtos%3D7726,7726,7726,7726,7726%26amtos%3D0,0,0,0,0%26mcvt%3D7726%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D9763%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D3417%26pst%3D2037%26dur%3D20015%26vmtime%3D10225%26dtos%3D4592%26dtoss%3D3%26dvs%3D4592%26dfvs%3D4592%26dvpt%3D4592%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26i2%3D33554707%26ic%3D512%26cs%3D50336531%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D4592,4592,4592,4592,4592%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D0%26ces%26femt%3D1122%26femvt%3D0%26emc%3D19%26emuc%3D0%26emb%3D13,0,0,0,0%26avms%3Dexc%26qi%3D61777526%26psm%3D-2147481858%26psv%3D1790%26psfv%3D1790%26psa%3D0%26pnk%3D1698444206785%26ptlt%3D1698444221087%26pngs%3D9s,14,15s%26veid%3Dsloi%3A1,ovms%3A1,xdi%3A0,amp%3A0,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,7726,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.12%26t%3D1698444208182?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 watchtime
www.youtube.com/api/stats/ Frame 5ECD 0
0 16ms
14ms Image
text/html 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/api/stats/watchtime?rti=10&st=0.000&et=10.225&rtn=20.000&ns=yt&fexp=44772139%2C44777649%2C44781409%2C44802463%2C44806075&el=adunit&cpn=rynfzjBT0iMi9O1-&docid=6DujLddsxag&visitordata=CgtuNC04LXFmVmlNaw%253D%253D&of=-_xhI4eL4MjOL53E0nwGhA&ver=2&cmt=10.225&fmt=18&rt=8.000&adformat=2_2_1&euri=https%3A%2F%2Fwww.dailyfaceoff.com%2F&len=20.016&vtype=gvp&c=web_gvp_ads&cver=h.0.0.0&cbr=Chrome&cbrver=118.0.5993.117&cos=Win32&cosver=537.36&cplatform=desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H2 200 liveView.php
live.primis.tech/live/ 0
419 B 40ms
39ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTI1JaNypaZypyRcoWU9MTY5ODQ0NDIjNCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTEmNwp4JaN0YT0jJat9NwQjJax9NDQjJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzp2Reqw0zqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZxqXI9ODA3JzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMwIjNwYzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD05NDAkMwx1NDx=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:41 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: xQ8c6qX-se8i-lcT2sN4EdrSGQImr04YTzKxqTMcjKcrlRY4gni8yQ==

GET
H2 200 liveView.php
live.primis.tech/live/ 0
421 B 26ms
25ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTQlJaNypaZypyRcoWU9MTY5ODQ0NDIjNCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTEmNwp4JaN0YT0jJat9NwQjJax9NDQjJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzp2Reqw0zqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZxqXI9ODA4JzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMwIkMDEzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD0lMDE3MDE0Mwt0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:41 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: 8_t4CWF9XY9S-h5yWiEWsbK_5lVFCx3PASxZZOjr2I66P7-_6Az6MA==

GET
H2 200 w_480_00002.ts Show response
video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/ 192 KB
192 KB 32ms
32ms XHR
video/mp2t 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/w_480_00002.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e77a464af87629a27feea4fd850774095aa96475f6fc7d2b7a9412f1f98cf459

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 06:17:05 GMT
via: 1.1 c1a6a510f3f008881a299e0b31f8558c.cloudfront.net (CloudFront), 1.1 1872df29670137f21773bdb80da38e36.cloudfront.net (CloudFront)
x-amz-cf-pop: LAX3-C4, LHR50-P3
age: 56796
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 196272
last-modified: Fri, 27 Oct 2023 04:25:00 GMT
server: nginx
etag: "6fcd7bd7bb20d998461eba963362d4f6"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: 996tiUeCcvrZoV-fO_udmUjcQRG8lM5VRS_R-Y90D8gDK7b5aq7wiw==
expires: Fri, 10 Nov 2023 06:17:05 GMT

GET
H2 200 w_480_00003.ts Show response
video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/ 192 KB
193 KB 25ms
25ms XHR
video/mp2t 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/w_480_00003.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: f314fd73c799e8d26e1831a85d38db69d40ee984d7b26233bf89a66f933bcd5f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 06:17:06 GMT
via: 1.1 b291286a8ed764ccc4372393caf68cc0.cloudfront.net (CloudFront), 1.1 1872df29670137f21773bdb80da38e36.cloudfront.net (CloudFront)
x-amz-cf-pop: DFW53-C1, LHR50-P3
age: 56800
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 197024
last-modified: Fri, 27 Oct 2023 04:25:00 GMT
server: nginx
etag: "1017c6872986d434db49f40177b89dd5"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: aoluM_rMo2uVaWsuVZlbj-V_2Hfl6Bqk-rEmDO2FlsPpXAN62uAqWg==
expires: Fri, 10 Nov 2023 06:17:06 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
64 B 43ms
42ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=C5vYBrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBNwCT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsXF8uP7zje5pBo7849i6-K8e7ogXxjf7We6_7uUCA5Yx9j9lUM2THyu271PekvpzGlBTaZ7dLP5_exLlwAT33bCyygTgBAGIBd_MtPdMoAZUgAejs8WMBKgH2baxAqgHjs4bqAeT2BuoB5zcG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAtgHAagIAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTMzMjIwNDE5MTc3Nzc5OTaACgPICwHaDBAKChCwnbKLta7cwDMSAgEDqg0CREXiDRMI7OO23Z2XggMVaIuDBx3kfAQXsBPS0I4V2BMC2BQB0BUBmBYBqBYB-BYBgBcB&sigh=tTTUkrSgqAo&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&label=videoplaytime75&ad_mt=15620&sdkv=h.3.599.0&vci=CpgBCAESHnNlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldBoHQWRTZW5zZSAEKgw2MDgwNDY3NTIwNTIyDDY3NzMxNDQ4NzY5NEDEAlImEA8lAACgQSgBOgs2RHVqTGRkc3hhZ0IJZ29vZ2xlYWRzSLoYUABaImRvdWJsZWNsaWNrYnlnb29nbGUuY29tLW9taWQtdmlkZW8YAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=960585;acvw=sv%3D958%26cb%3Dima%26e%3D3%26nas%3D1%26sdk%3Dh%26p%3D581,400,950,1056%26tos%3D13128,0,0,0,0%26mtos%3D13128,13128,13128...
ade.googlesyndication.com/ddm/activity_ext/ Frame 5ECD 42 B
63 B 46ms
45ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=960585;acvw=sv%3D958%26cb%3Dima%26e%3D3%26nas%3D1%26sdk%3Dh%26p%3D581,400,950,1056%26tos%3D13128,0,0,0,0%26mtos%3D13128,13128,13128,13128,13128%26amtos%3D0,0,0,0,0%26mcvt%3D13128%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D15165%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D4430%26pst%3D2037%26dur%3D20015%26vmtime%3D15619%26dtos%3D5402%26dtoss%3D4%26dvs%3D5402%26dfvs%3D5402%26dvpt%3D5402%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26i2%3D33554707%26i3%3D33554707%26ic%3D0%26cs%3D50336531%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D5402,5402,5402,5402,5402%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D0%26ces%26femt%3D1122%26femvt%3D0%26emc%3D27%26emuc%3D0%26emb%3D21,0,0,0,0%26avms%3Dexc%26qi%3D61777526%26psm%3D-2147418370%26psv%3D65278%26psfv%3D65278%26psa%3D0%26pnk%3D1698444206785%26ptlt%3D1698444226489%26pngs%3D9s,14,15s%26veid%3Dsloi%3A1,ovms%3A1,xdi%3A0,amp%3A0,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,13128,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.12%26t%3D1698444208182?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 delayplay
www.youtube.com/api/stats/ Frame 5ECD 0
0 19ms
18ms Image
text/html 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/api/stats/delayplay?ns=yt&fexp=44772139%2C44777649%2C44781409%2C44802463%2C44806075&el=adunit&cpn=rynfzjBT0iMi9O1-&docid=6DujLddsxag&visitordata=CgtuNC04LXFmVmlNaw%253D%253D&of=-_xhI4eL4MjOL53E0nwGhA&ver=2&cmt=18.148&fmt=18&rt=16.000&adformat=2_2_1&euri=https%3A%2F%2Fwww.dailyfaceoff.com%2F&len=20.016&vtype=gvp&c=web_gvp_ads&cver=h.0.0.0&cbr=Chrome&cbrver=118.0.5993.117&cos=Win32&cosver=537.36&cplatform=desktop&mos=1&volume=0&delay=18
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H2 200 w_480_00004.ts Show response
video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/ 189 KB
190 KB 25ms
25ms XHR
video/mp2t 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/w_480_00004.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: cd00f32aac73cc85d1c849f8c97e7baa0ffe1716815f1bd74f05ced736bae193

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 06:17:05 GMT
via: 1.1 8812178a174bf0625299e1bd0e9ac280.cloudfront.net (CloudFront), 1.1 1872df29670137f21773bdb80da38e36.cloudfront.net (CloudFront)
x-amz-cf-pop: MCI50-P1, LHR50-P3
age: 56803
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 194016
last-modified: Fri, 27 Oct 2023 04:25:00 GMT
server: nginx
etag: "a477cfabdd699fad1163ff61b9b57011"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
accept-ranges: bytes
x-amz-cf-id: N_JrRbANfGKOF8dtsUhPHqr6fxsbtwgu1h1kA94GWBaGIADG28ldlw==
expires: Fri, 10 Nov 2023 06:17:05 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
420 B 41ms
41ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTI1JaNypaZypyRcoWU9MTY5ODQ0NDIjNCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTEmNwp4JaN0YT0jJat9NwQjJax9NDQjJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzp2Reqw0zqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZxqXI9ODA1JzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMmAkMTIzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD01MwA4OTQ0NmY=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:49 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: KDYiIYEc1pjBZkEmN2rIaRglbcXQrM5uE9kOdRnV5n_Ry4z4c33oJQ==

GET
H2 200 liveView.php
live.primis.tech/live/ 0
421 B 41ms
41ms Image
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTQlJaNypaZypyRcoWU9MTY5ODQ0NDIjNCZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTEmNwp4JaN0YT0jJat9NwQjJax9NDQjJaZcZF9jYXNmRG9gYWyhPXq3ql5xYWyfrWZuY2ViZzYhY29gJaN1YxyxPXq3ql5xYWyfrWZuY2ViZzYhY29gJzRyYaVaSW5zo3JgYXRco249JzymQXBjPTAzp2Reqw0zqXNypxyjQWRxpw0lMDAkJTNBYWM4JTNBMwAyM0EmYTAjJTNBMTAkMvUmQWQ1ZTAyM0FuMwBzJTNBNwp1MlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxYkMTthMC41OTxmLwEkNlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwUmYmMmYWNvNwt4NlZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZxqXI9ODAkJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2OTt0NDQlMmAkMTMzqWyxPVNyn2yhZG9TUGkurWVlNwUmYmMmYWNxNwMjZCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZ3q3phZGFcoHyzYWNyo2ZzLzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQzpHucZD0lMDUjODx4NDQ0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:49 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
x-amz-cf-id: CJLnzxXHywwJnNV26JqKKPorjyd3YyVq00vEvxu9myIIDsCcnwoa1g==

GET
H2 200 w_480_00005.ts Show response
video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/ 231 KB
232 KB 24ms
24ms XHR
video/mp2t 2600:9000:23d3:6000:1:6448:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn1/video/users/hls/31368/video_63f630bff01fd049643110/vid653b1ae33ca6b558133018.mp4/w_480_00005.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_3.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23d3:6000:1:6448:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0f120e2007bcaafbbd76bfc0898747be2d8630e31cdf9a494b9a54de1355b9f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dailyfaceoff.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 06:17:15 GMT
via: 1.1 98c9abb82906e5df5d993116d0614420.cloudfront.net (CloudFront), 1.1 1872df29670137f21773bdb80da38e36.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1, LHR50-P3
age: 56796
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 236504
last-modified: Fri, 27 Oct 2023 04:25:00 GMT
server: nginx
etag: "4f13ade41eb8ff91c5313de59a9d2e40"
access-control-max-age: 604800
access-control-allow-methods: GET, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cache-control: max-age=1209600
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: ybO9eKN3xuGpSUAwYtq5Z-VQNzzh_YHJg80oxeaIOh0n7LFBsUBEZw==
expires: Fri, 10 Nov 2023 06:17:15 GMT

GET
H3 204 watchtime
www.youtube.com/api/stats/ Frame 5ECD 0
0 14ms
14ms Image
text/html 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/api/stats/watchtime?rti=20&st=10.225&et=20.016&final=1&ns=yt&fexp=44772139%2C44777649%2C44781409%2C44802463%2C44806075&el=adunit&cpn=rynfzjBT0iMi9O1-&docid=6DujLddsxag&visitordata=CgtuNC04LXFmVmlNaw%253D%253D&of=-_xhI4eL4MjOL53E0nwGhA&ver=2&cmt=20.016&fmt=18&rt=19.000&adformat=2_2_1&euri=https%3A%2F%2Fwww.dailyfaceoff.com%2F&len=20.016&vtype=gvp&c=web_gvp_ads&cver=h.0.0.0&cbr=Chrome&cbrver=118.0.5993.117&cos=Win32&cosver=537.36&cplatform=desktop
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 5ECD 42 B
64 B 45ms
45ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=C5vYBrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBNwCT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsXF8uP7zje5pBo7849i6-K8e7ogXxjf7We6_7uUCA5Yx9j9lUM2THyu271PekvpzGlBTaZ7dLP5_exLlwAT33bCyygTgBAGIBd_MtPdMoAZUgAejs8WMBKgH2baxAqgHjs4bqAeT2BuoB5zcG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHyqmxAqgH66WxAtgHAagIAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTMzMjIwNDE5MTc3Nzc5OTaACgPICwHaDBAKChCwnbKLta7cwDMSAgEDqg0CREXiDRMI7OO23Z2XggMVaIuDBx3kfAQXsBPS0I4V2BMC2BQB0BUBmBYBqBYB-BYBgBcB&sigh=tTTUkrSgqAo&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&label=videoplaytime100&ad_mt=20016&sdkv=h.3.599.0&vci=CpgBCAESHnNlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldBoHQWRTZW5zZSAEKgw2MDgwNDY3NTIwNTIyDDY3NzMxNDQ4NzY5NEDEAlImEA8lAACgQSgBOgs2RHVqTGRkc3hhZ0IJZ29vZ2xlYWRzSLoYUABaImRvdWJsZWNsaWNrYnlnb29nbGUuY29tLW9taWQtdmlkZW8YAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=13;acvw=sv%3D958%26cb%3Dima%26e%3D4%26nas%3D1%26sdk%3Dh%26p%3D581,400,950,1056%26p0%3D581,-2600,950,-1944%26p1%3D581,400,950,1056%2...
ade.googlesyndication.com/ddm/activity_ext/ Frame 5ECD 42 B
63 B 46ms
45ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=13;acvw=sv%3D958%26cb%3Dima%26e%3D4%26nas%3D1%26sdk%3Dh%26p%3D581,400,950,1056%26p0%3D581,-2600,950,-1944%26p1%3D581,400,950,1056%26p2%3D581,400,950,1056%26p3%3D581,400,950,1056%26tos%3D18212,0,0,0,0%26mtos%3D18212,18212,18212,18212,18212%26amtos%3D0,0,0,0,0%26mtos1%3D3134,0,0%26mtos2%3D4592,0,0%26mtos3%3D5402,0,0%26mcvt%3D18212%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26a0%3D0%26a1%3D0%26a2%3D0%26a3%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D20249%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D5303%26pst%3D2037%26dur%3D20015%26vmtime%3D20015%26dtos%3D5084%26dtoss%3D5%26dvs%3D5084%26dfvs%3D5084%26dvpt%3D5084%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26i2%3D33554707%26i3%3D33554707%26ic%3D0%26cs%3D50336531%26c%3D1%26c0%3D0%26c1%3D0,1,1%26c2%3D1%26c3%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D5084,5084,5084,5084,5084%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D0%26ces%26femt%3D1122%26femvt%3D0%26emc%3D35%26emuc%3D0%26emb%3D29,0,0,0,0%26avms%3Dexc%26qi%3D61777526%26psm%3D-2145386754%26psv%3D2096894%26psfv%3D2096894%26psa%3D0%26pnk%3D1698444206785%26ptlt%3D1698444231573%26pngs%3D9s,14,15s%26veid%3Dsloi%3A1,ovms%3A1,xdi%3A0,amp%3A0,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,18212,0%26ss0%3D0%26ss1%3D0,0.12,0.12%26ss2%3D0.12%26ss3%3D0.12;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.12%26t%3D1698444208182?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

204

aclk
www.googleadservices.com/pagead/ Frame 5ECD
Redirect Chain

https://googleads.g.doubleclick.net/aclk?sa=l&ai=CvF7jrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHij...
https://www.googleadservices.com/pagead/aclk?sa=L&ai=Ci42MrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECW...

0
0

34ms
17ms

Image
text/html

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googleadservices.com/pagead/aclk?sa=L&ai=Ci42MrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsSl9GuL7t3hblF8KY6RdeMK0drm6XnMuzc9pUtAmCTU73yen202ispFFwn3GJQ7_O4bl_7DxNC28424Cpn1lwAT33bCyygTgBAGIBd_MtPdMkgUICAMQAhgBUAHABW6gBlSAB6OzxYwEqAfZtrECqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcBqAgB0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tMzMyMjA0MTkxNzc3Nzk5NpoJQmh0dHBzOi8vd3d3LmF1ZGlibGUuZGUvY2F0L0tyaW1pcy1UaHJpbGxlci1Ib2VyYnVlY2hlci8xNjIwOTkxMDAzMbEJWpn5y51i6uaACgPICwHQCw_gCwHaDBAKChCwnbKLta7cwDMSAgEDmg0BD6oNAkRFyA0B4g0TCOzjtt2dl4IDFWiLgwcd5HwEF7AT0tCOFdgTAtgUAdAVAZgWAagWAfgWAYAXAQ&ase=2&gclid=EAIaIQobChMIpP233Z2XggMVaIuDBx3kfAQXEAEYASAAEgKmA_D_BwE&num=1&cid=CAQSOwDICaaNfoRUiwQZvmBqobFb2SR8NlSau9ToXz3PD2F8c2KxpmMZoyk_Oq8cjzg-ORee26kIqC30XyzGGAE&client=ca-video-pub-1320774679920841&ctype=110&label=video_engaged_view&dblrd=1&sig=AOD64_30vVGKpi7dmm4ZeVDRRl-1GofRzQ&adurl=https://ad.doubleclick.net/ddm/trackclk/N1884730.279382DBMGROUPM-XAXISLI/B30829935.378629896%3Bdc_trk_aid%3D569609914%3Bdc_trk_cid%3D202625982%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bltd%3D%3Bdc_tdv%3D1
Protocol: H3
Server: 142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
server: adclick_server
p3p: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/aclk?sa=L&ai=Ci42MrzM8ZeTpM-iWjuwP5PmRuAGfxYHuc7TCpJPZEbCQHxABIMCoympgleKQgqAHoAGj-_SsKcgBBakCOm0nL2q7sT7gAgCoAwGYBACqBN8CT9DD4oHowVN-n25vBvggoo9q0vOEcDRUECWIHijGiFyuTXWtZikkXG_WkjI2yxGefOAFWAIQyBym1CSEol8YLrQy-1sbyWk02QfVCU826RPrNqDxT6z05D5ZG_oMVHpK5KlmMtOvxdoE1iD7Jc1xXOQAgwx-_Ed-cswU60fItGOxIi5VFJAxHAJhRzQmiubSmCU_N99bbtw_yddzYGRQZsQvQiwQ5uRTjCwDXvRG0ZraoKTuLAaIKRgUcOFYspZsjm9lFDuXiT1mlijV-4T-oqJV6xve-WfpCAD-TqmAT1P_7kNN-s4RaZav3HsaMA87EDFYG7R4hliQQilKszF_36aG6j7Tuyn8AJSJrlq1GaIcWW-QpvfsihWe5o-YIsOIsSl9GuL7t3hblF8KY6RdeMK0drm6XnMuzc9pUtAmCTU73yen202ispFFwn3GJQ7_O4bl_7DxNC28424Cpn1lwAT33bCyygTgBAGIBd_MtPdMkgUICAMQAhgBUAHABW6gBlSAB6OzxYwEqAfZtrECqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcBqAgB0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tMzMyMjA0MTkxNzc3Nzk5NpoJQmh0dHBzOi8vd3d3LmF1ZGlibGUuZGUvY2F0L0tyaW1pcy1UaHJpbGxlci1Ib2VyYnVlY2hlci8xNjIwOTkxMDAzMbEJWpn5y51i6uaACgPICwHQCw_gCwHaDBAKChCwnbKLta7cwDMSAgEDmg0BD6oNAkRFyA0B4g0TCOzjtt2dl4IDFWiLgwcd5HwEF7AT0tCOFdgTAtgUAdAVAZgWAagWAfgWAYAXAQ&ase=2&gclid=EAIaIQobChMIpP233Z2XggMVaIuDBx3kfAQXEAEYASAAEgKmA_D_BwE&num=1&cid=CAQSOwDICaaNfoRUiwQZvmBqobFb2SR8NlSau9ToXz3PD2F8c2KxpmMZoyk_Oq8cjzg-ORee26kIqC30XyzGGAE&client=ca-video-pub-1320774679920841&ctype=110&label=video_engaged_view&dblrd=1&sig=AOD64_30vVGKpi7dmm4ZeVDRRl-1GofRzQ&adurl=https://ad.doubleclick.net/ddm/trackclk/N1884730.279382DBMGROUPM-XAXISLI/B30829935.378629896%3Bdc_trk_aid%3D569609914%3Bdc_trk_cid%3D202625982%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bltd%3D%3Bdc_tdv%3D1
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=200034;
ade.googlesyndication.com/ddm/activity_ext/ Frame 5ECD 42 B
63 B 43ms
42ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=1110824260793765247;met=1;ecn1=1;etm1=0;eid1=200034;?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
shb.richaudience.com/hb/ Frame 3EF7 4 B
239 B 19ms
18ms XHR
text/html 157.90.3.144
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://shb.richaudience.com/hb/
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 157.90.3.144 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.144.3.90.157.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: d6dffe998d4d52601dd56a1666bbd09f6926bc110429c434402ca7a814080808

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 27 Oct 2023 22:03:52 GMT
content-encoding: gzip
server: nginx/1.14.2
vary: Accept-Encoding, Accept-Encoding
access-control-max-age: 86400
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
access-control-allow-credentials: true

GET
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame 3EF7 37 B
492 B 95ms
94ms XHR
application/json 104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=491831&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%222149651c768dbe7%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.dailyfaceoff.com%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A2%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A2%2C%22ren%22%3Afalse%2C%22version%22%3A%227.16.0%22%2C%22userIds%22%3A%5B%22pubProvidedId%22%5D%2C%22url%22%3A%22https%3A%2F%2Fwww.dailyfaceoff.com%2F%22%2C%22tmax%22%3A3000%2C%22syncsPerBidder%22%3A5%2C%22pbadslot%22%3A%22%2FPRM%2F113678%2Fwww_dailyfaceoff_com%22%2C%22adunitcode%22%3A%22adUnit_17%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22222af693dbd5abe%22%2C%22ext%22%3A%7B%22siteID%22%3A%22491831%22%2C%22tid%22%3A%2248bf9db3-9942-49fe-a7ac-7f5f0142644c%22%2C%22sid%22%3A%22656x369%22%2C%22fl%22%3A%22x%22%2C%22gpid%22%3A%22%2FPRM%2F113678%2Fwww_dailyfaceoff_com%22%7D%2C%22video%22%3A%7B%22playerSize%22%3A%5B%5B656%2C369%5D%5D%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22placement%22%3A3%2C%22plcmt%22%3A2%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22playbackmethod%22%3A%5B6%5D%2C%22w%22%3A656%2C%22h%22%3A369%7D%2C%22bidfloor%22%3A0.7%2C%22bidfloorcur%22%3A%22USD%22%7D%2C%7B%22id%22%3A%2223ca2bbd5370067%22%2C%22ext%22%3A%7B%22siteID%22%3A%221014833%22%2C%22tid%22%3A%2268f21bd4-899d-4811-8e12-87fe22315395%22%2C%22sid%22%3A%22656x369%22%2C%22fl%22%3A%22x%22%2C%22gpid%22%3A%22%2FPRM%2F113678%2Fwww_dailyfaceoff_com%22%7D%2C%22video%22%3A%7B%22playerSize%22%3A%5B%5B656%2C369%5D%5D%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22application%2Fjavascript%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A1%2C%22maxduration%22%3A200%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22placement%22%3A3%2C%22plcmt%22%3A2%2C%22startdelay%22%3A0%2C%22skip%22%3A1%2C%22playbackmethod%22%3A%5B6%5D%2C%22w%22%3A656%2C%22h%22%3A369%7D%2C%22bidfloor%22%3A0.7%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22primis.tech%22%2C%22sid%22%3A%2231368%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%220%22%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22114a0e8a-47ec-4838-98cd-d83c33a69030%22%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%7D
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9cf6bfd47e958bde8fb8a21df87654c4238f813ee91d16aed75a81cd924a8e1

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:52 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FFfzh%2F%2BvuhrbPOBEb58dfeR2axWqRlBJOVEnbhtpDYIkOJ4vVIo0bWdOJypocqk6DAdHHYCEYSZz5w5gjUBNtiKTp2PWqHFubm2pao%2BjnC8n43Du%2FSbhD0thhb00jyW8srY1WWR%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 81ce3b439cc9904e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 liveInternalSsp.php Show response
rtb.primis.tech/live/ Frame 3EF7 25 B
493 B 281ms
281ms XHR
text/html 2600:9000:2251:9c00:1a:5235:f980:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.primis.tech/live/liveInternalSsp.php?sspData=%7B%22enc%22%3Atrue%2C%22comp%22%3Atrue%2C%22data%22%3A%22%5C%22rJmgWVgT4mbS%2FwVUmXzIl5s4xxphz1y2tEMNj%2BGRxzUy0rBIPcJMtF8%2FoVz2ZGOYtWVd2VNUcZkEsXF3d%2FiegelXHhlF4S0RpN2L9gis14EXN%2F%2FDQ7uhKThtRUi226W8sawbJoQCmGhzBwlKdcKpENYhBe5Z3eX%2Fj%2B7%2FkgATsl89Mvl0UGY5vRPDRhu6Y24QJYg2UVYIx2NwGymwmI%2FT3z5N%2FXZsErfZxydFJg%2FStiDmEav2uCaLF7VxWiVvYGfAikDOgOENDjLmG6rCudWISsMPus6dMTzNQYW5lZejme7GfzYJyqUGuZ8J7%2FUs%2FniaL8tgkUT1kcuyqnrORuTNLG8U13n2hlL4TwbovTrComW7JaPZU64bK4C3J4H%2BPl11N6K2Rc3ltcQ9w6P1LlIx5Wns4Re4HhmgUBnkrbWjdbVw3bwaEPSsbqorIo0Gc%2FoXfEx96ZQ%2F0LJEr%2BEloh7ys%2Bbq8f%2B%2BjUWoEEFr%2BxBI5h3Ph2T%2BB3mgV1VJexw%2BuYK%2BZRlyXtQ55a%2F68h9icls6ua5Jo8AM%2FmPBN7jROTSBXAZB5iyriFuEXuDAsibXnIUEqsQYx0gxwY19L%2FDaxLIqmYyV5vXujcYnddecEADBlsN%2BzUejZyB1jHuQf6J0l2KwVCX1mlV8qehqVlBn3fOGEL5nrZuiNpXr6xJkQS7FkG4D8VmQW4Tim3yJ8s20csIpqYAkIxEWx5JXU1yAV7CswkqiJ%2FQbZZLVOw1Ojc5ZxBURogd9LBbVWgigrJabhdwMXQO7pMvZqDPZ2pbepb6x%2FNkLjqXWEpnVCY%2FkhVy4UyaBg4wnYEkonau3JJqUWSpoZxyhzbIn8EzCbXlHDuF%2BjWhBesDkhoWYVlOT69eJvvSOpBQuaCqZZwE7Lmz%2BORCIFR0pkU13%2BY5EQRHDcLMbNd2C3KyLQIqwy133Imz0vkokTN4mPPAImBzLOQon2COLhfZkhK3o%2FEeKozjD0Y0MPzBw29GzDKedHNPC42L9v%2BYEjRm5JEOmrUejoJ5F2WlR4WJWZDdOlpKPaeC4N6UL2yZArr6XJq%2BRYVfiSF6iw9zKvl1Sx9XUZEdHLEEQJWyzldTOSlb3mU6YLtcEQ5N4Y5Pk0oQROM0CNtrjhpgFE2fGsWEpFlQBp7gICedy0yME65aBzGxDZljkyI2BSlpfBvoWefPLe9YbgK0QXoPOBz1AfctiqFS6BSUQiaF7e5FnCiL3Ine2bvNjMj6XpE06GfQdOwKnEw2guPhFXtlvNJdaic0wKxFlWckJWR2mtgjNqf2R7IM6yv8I6gC8TSm5VrVH%2FnLRJNd1dU4DcAhC1IwUR0%2FyVj35fZmwnmiQgr66cAgAvxFuQGOkfMtUEQlVB%2FU9EZqTXYVAXNlrCXGSO6ejkzPETahbnHHCwFWLrQcqVlMOawI7R5IfS87NuidrGq5GuV8ubZvm621OzIS6iqvtDwDoRNrZ3fUfs9Iw3oIIbF1snZ1VgFuNGEXyxtO2HDOcBEEn36L9FSby3Pm%2FctB%2FMb4oMg46JBiLmE%2FrdBlNcyE5czG0AIR9qTzO5q9NORc3s2M5etQuhj0u5nD1DffklJKxS%2FFsK0sTWa5SwxE0s7brQYzq1k84plszKMwtxwboXhshsv6CUM%2Fme6uy8%2Bt6LzXw0EpcZkB7%2FUD035qld%2ByRKpqJ7NhJ8%2BWyPJR%2FP6XphifoS1aUOpWpVYJ%2FJ1t9U89uzdRzf9%2B0ircDcGs6d513ENYHUx5Q4VDAGZDqOoYuRbiQtrpRGfBTi580PotXsvDXTfBC58oNWQVmt9nWyPM8KrWOClg8felMzcab7D%2BiHQ5MoX8MB08uSukFYO1oIEde6RGvJH68fL3x5YtlyH8%2FvNK6%2B4Ebe0CUGM6G%2FnsaCm9O4FmjGUTRCsh%2FQuRm5i4SRFGv%2FvpAvwFvCyC0CtMb8%2BSgAEVeztCULLMZ8BcAprXsEnBbq38wbIAlqippwfTmOTjTiP2Di02552GEfKLv4NrT1Tk40IwwBomSSboksxxyq75%2BVPK4xwi5duM97NNBHmxs7k80o3wfUsP0xNHchM8BAeZEoXwaQHlQ9LLeneBql%2FOic%2FcgUahA2ekJhHoP56%2FqBGobyd4RiJE5QWkqh68w2are%2FWfKz8%2FWtVx48AF6eQJXJmwwzQ1183%2Bza8F0aH8Avv733A%3D%3D%5C%22%22%7D
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:9c00:1a:5235:f980:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 1d16d42e33c80a00df5f4c6a514edbfaa985a2cdf0d33b4f76f90a6625b773b7

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:52 GMT
content-encoding: gzip
via: 1.1 79272ab9b399ee696b329d4f677dca48.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.dailyfaceoff.com
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
access-control-allow-credentials: true
x-amz-cf-id: zZ5HcpIMbotsayd_xR70QH2GMQSJAd3kdqArd65R6zFoWRb_LIM_rg==

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 3EF7 0
61 B 26ms
26ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:52 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 3EF7 0
61 B 27ms
26ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.dailyfaceoff.com
date: Fri, 27 Oct 2023 22:03:50 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H/1.1 200
OK auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame 3EF7 184 B
477 B 30ms
15ms XHR
application/json 69.173.144.137
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.144.137 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a32e726771fae845099a4e20226724d9a5f691ba6a9d53b72f9f81b7990a7b8c

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
content-encoding: gzip
x-prebid: pbs-java/2.1.0
Content-Type: application/json
access-control-allow-origin: https://www.dailyfaceoff.com
Cache-Control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
Expires: 0

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame 3EF7 145 B
998 B 153ms
128ms XHR
application/json 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.7.16.0_15.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

8fa2304416c7666ddd843d6c090170df851181a43cf8244572288a027f9fd0bc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.dailyfaceoff.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 27 Oct 2023 22:03:52 GMT
an-x-request-uuid: 56e066c3-46d3-43b7-896c-c3f36f04b3fa
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.dailyfaceoff.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.77; 45.141.152.77; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 145
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ Frame 3EF7 23 B
465 B 46ms
45ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.dailyfaceoff.com%2F&pid=raZFHmvMiGgbJ&cb=1&ws=1x1&v=23.1020.1619&t=2000&slots=%5B%7B%22fc%22%3A%22USD%22%2C%22fp%22%3A80%2C%22id%22%3A%22Amazon_Video_400x225_Mob%22%2C%22mt%22%3A%22v%22%7D%5D&pubid=48ce1010-d9fb-4e4a-9180-d1a0eb720b79&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS