blip.fm Open in urlscan Pro
54.163.233.121 Public Scan

Software

ESF /

Resource Hash

1d58ec10678df035f4fd517509f207848056cc21dfb1066c40508368942cda9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA"
expires: Thu, 16 Sep 2021 08:45:19 GMT

GET
H/1.1 200
OK loadPage Show response
blip.fm/ajax/ 18 B
414 B 233ms
180ms XHR
application/json 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://blip.fm/ajax/loadPage?page=1&bliperId=3034111
Requested by: Host: blip.fm
URL: https://blip.fm/_/js/base.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 / PHP/7.0.19
Resource Hash: 67f2b0a60f37796c436ea0d9f947a22cb196312a87705d10069b65acc2993f01

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
Cookie: __utma=171230451.624044984.1631781919.1631781919.1631781919.1; __utmc=171230451; __utmz=171230451.1631781919.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1631781919
Connection: keep-alive
X-Fuzz-Ajax: true
Referer: https://blip.fm/cheekcomma49
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/cheekcomma49
X-Requested-With: XMLHttpRequest
X-Fuzz-Ajax: true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:43:55 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
X-Powered-By: PHP/7.0.19
Content-Type: application/json
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Keep-Alive: timeout=5, max=90
Content-Length: 18
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 rules-p-b0cBKofGeCYKg.js Show response
rules.quantcount.com/ 3 B
438 B 30ms
7ms Script
application/javascript 18.66.97.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-b0cBKofGeCYKg.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 20:40:27 GMT
via: 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
age: 43493
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 20:48:31 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: Mw4hjgkswPOWED8zpMtCDD_cleb4bMq5RrOqiScEz0YGJeUOaMQ3rQ==

GET
H2 200 rules-p-c4o3JsfzdTxY6.js Show response
rules.quantcount.com/ 3 B
437 B 31ms
8ms Script
application/javascript 18.66.97.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-c4o3JsfzdTxY6.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 05:21:55 GMT
via: 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
age: 12205
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 20:53:31 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: 2A1YDSD7irIymBu3AYrqHsfEXrtARi3evBdjtsoq-3fdiMBKpaEO8A==

GET
H/1.1 200
OK noticebg-black.png
blip.fm/images/ 2 KB
3 KB 1064ms
104ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/noticebg-black.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: 3983c27985f9ae67aed69d7ca6a82a682a7095df30b8d8253014de0f4ee97427

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.624044984.1631781919.1631781919.1631781919.1; __utmc=171230451; __utmz=171230451.1631781919.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1631781919; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:43:56 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:53 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "9d5-5ac0643edea40"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=82
Content-Length: 2517

GET
H/1.1 200
OK dockbg.png
blip.fm/images/ 607 B
939 B 418ms
97ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/dockbg.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: c04e372715cffbc60a3f59d89c6ba50bb9f8adbc36c2e75cbd155f4ae1a911e8

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.624044984.1631781919.1631781919.1631781919.1; __utmc=171230451; __utmz=171230451.1631781919.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1631781919; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:43:56 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:37 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "25f-5ac0642f9c640"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=88
Content-Length: 607

GET
H/1.1 200
OK alert.png
blip.fm/images/icons/ 3 KB
4 KB 642ms
97ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/icons/alert.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: 4db8af548255ad1270380918e096b18fddd5b984f95fd4862f18575f8267162f

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.624044984.1631781919.1631781919.1631781919.1; __utmc=171230451; __utmz=171230451.1631781919.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1631781919; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:43:56 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:49 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "d77-5ac0643b0e140"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=86
Content-Length: 3447

GET
H/1.1 200
OK sprite-uber.png
blip.fm/images/blip/ 64 KB
65 KB 544ms
126ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/blip/sprite-uber.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: 9585f9660d61236506d8fe0d442168949a866c238ee7fe8c5f32b0aec2b29d71

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.624044984.1631781919.1631781919.1631781919.1; __utmc=171230451; __utmz=171230451.1631781919.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1631781919; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:43:56 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:43 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "1015e-5ac06435553c0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=87
Content-Length: 65886

GET
H/1.1 200
OK dialogbg.png
blip.fm/images/ 6 KB
6 KB 319ms
99ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/dialogbg.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: 8389ab2ff25b494852f8aa7c6972c69140ffb4f74ad5fb5f030d6ed3a1160359

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.624044984.1631781919.1631781919.1631781919.1; __utmc=171230451; __utmz=171230451.1631781919.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1631781919; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:43:56 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:44 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "17ce-5ac0643649600"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=89
Content-Length: 6094

GET
H2 200 pixel;r=1836576309;rf=0;a=p-b0cBKofGeCYKg;url=https%3A%2F%2Fblip.fm%2Fcheekcomma49;uht=2;fpan=1;fpa=P0-2058341709-1631781919067;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref...
pixel.quantserve.com/ 35 B
371 B 29ms
22ms Image
image/gif 91.228.74.189
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1836576309;rf=0;a=p-b0cBKofGeCYKg;url=https%3A%2F%2Fblip.fm%2Fcheekcomma49;uht=2;fpan=1;fpa=P0-2058341709-1631781919067;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=blip.fm;je=0;sr=1600x1200x24;dst=0;et=1631781919067;tzo=0;ogl=title.Blip%252Efm%20-%20Listen%20to%20free%20music%2Ctype.website%2Cimage.https%3A%2F%2Fd1uswytv6491xe%252Ecloudfront%252Enet%2Fimages%2Fblip%2FblipIcon%252Epng%2Curl.http%3A%2F%2Fblip%252Efm%2Csite_name.Blip%252Efm

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.189 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:19 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 pixel;r=451482906;rf=0;a=p-c4o3JsfzdTxY6;url=https%3A%2F%2Fblip.fm%2Fcheekcomma49;uht=2;fpan=0;fpa=P0-2058341709-1631781919067;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=...
pixel.quantserve.com/ 35 B
371 B 29ms
22ms Image
image/gif 91.228.74.189
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=451482906;rf=0;a=p-c4o3JsfzdTxY6;url=https%3A%2F%2Fblip.fm%2Fcheekcomma49;uht=2;fpan=0;fpa=P0-2058341709-1631781919067;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=blip.fm;je=0;sr=1600x1200x24;dst=0;et=1631781919068;tzo=0;ogl=title.Blip%252Efm%20-%20Listen%20to%20free%20music%2Ctype.website%2Cimage.https%3A%2F%2Fd1uswytv6491xe%252Ecloudfront%252Enet%2Fimages%2Fblip%2FblipIcon%252Epng%2Curl.http%3A%2F%2Fblip%252Efm%2Csite_name.Blip%252Efm

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.189 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:19 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/1256b7e2/www-widgetapi.vflset/ 135 KB
44 KB 63ms
21ms Script
text/javascript 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1256b7e2/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da588f64f4fbfd746d132775505493b244ab8d6800def6413f9f016f90257454

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 06:29:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8135
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44724
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 19:13:02 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 16 Sep 2022 06:29:44 GMT

GET
H3 200 / Show response
www.youtube.com/embed/ Frame 9CAF 32 KB
10 KB 50ms
50ms Document
text/html 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/1256b7e2/www-widgetapi.vflset/www-widgetapi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

074f88c184a1ec3d9170f79dcc397efad12e9cef0fdd3d8504cd4bfe5b991b0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
cookie: YSC=aQ3KSe5e_2I; VISITOR_INFO1_LIVE=AjlClA6kAxA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 16 Sep 2021 08:45:19 GMT
strict-transport-security: max-age=31536000
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
report-to: {"group":"AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA"}]}
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: CONSENT=PENDING+610; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 www-player-webp.css
www.youtube.com/s/player/1256b7e2/ Frame 9CAF 329 KB
45 KB 24ms
24ms Stylesheet
text/css 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1256b7e2/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f48ebd2372c6d901f56fa7bb12d57960094e8efdff9099ee7f5e10c06ac2e513

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:28:11 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 13 Sep 2021 19:13:02 GMT
server: sffe
age: 148628
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46342
x-xss-protection: 0
expires: Wed, 14 Sep 2022 15:28:11 GMT

GET
H3 200 www-embed-player.js Show response
www.youtube.com/s/player/1256b7e2/www-embed-player.vflset/ Frame 9CAF 201 KB
66 KB 23ms
22ms Script
text/javascript 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1256b7e2/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f34e3dd42302f7589f4c05d28e501d2ebf24d1585e83db4aba1b7443d0a7cf6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:28:11 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 13 Sep 2021 19:13:02 GMT
server: sffe
age: 148628
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67242
x-xss-protection: 0
expires: Wed, 14 Sep 2022 15:28:11 GMT

GET
H3 200 base.js Show response
www.youtube.com/s/player/1256b7e2/player_ias.vflset/de_DE/ Frame 9CAF 2 MB
504 KB 35ms
34ms Script
text/javascript 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1256b7e2/player_ias.vflset/de_DE/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3ecd5e6658606bd3ebe5230987a60837c536ff525517218a8b3ddfd41d66311a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:29:40 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 13 Sep 2021 19:13:02 GMT
server: sffe
age: 148539
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 516210
x-xss-protection: 0
expires: Wed, 14 Sep 2022 15:29:40 GMT

GET
H3 200 fetch-polyfill.js Show response
www.youtube.com/s/player/1256b7e2/fetch-polyfill.vflset/ Frame 9CAF 8 KB
3 KB 33ms
33ms Script
text/javascript 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1256b7e2/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:28:11 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 13 Sep 2021 19:13:02 GMT
server: sffe
age: 148628
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2830
x-xss-protection: 0
expires: Wed, 14 Sep 2022 15:28:11 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 9CAF 15 KB
15 KB 36ms
14ms Font
font/woff2 172.217.16.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f3.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 19:58:13 GMT
x-content-type-options: nosniff
age: 218826
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 13 Sep 2022 19:58:13 GMT

GET
H3

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame 9CAF
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

113 B
161 B

63ms
32ms

XHR
application/json

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f102.1e100.net

Software

cafe /

Resource Hash

ad31bdb30fff9c9aba3369934c5d9b1a5d47a785a1a5c9278e841695dd25fd41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 16 Sep 2021 08:45:19 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame 9CAF 29 B
609 B 69ms
16ms Script
text/javascript 172.217.18.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/1256b7e2/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:39:16 GMT
x-content-type-options: nosniff
age: 363
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 16 Sep 2021 08:54:16 GMT

GET
H3 200 remote.js Show response
www.youtube.com/s/player/1256b7e2/player_ias.vflset/de_DE/ Frame 9CAF 95 KB
29 KB 22ms
22ms Script
text/javascript 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1256b7e2/player_ias.vflset/de_DE/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/1256b7e2/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9e30dccc8ac3d91e997eee228488bd5650602f3ce2734beadf6d21cbcc328ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:29:58 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 13 Sep 2021 19:13:02 GMT
server: sffe
age: 148521
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29907
x-xss-protection: 0
expires: Wed, 14 Sep 2022 15:29:58 GMT

GET
H3 200 embed.js Show response
www.youtube.com/s/player/1256b7e2/player_ias.vflset/de_DE/ Frame 9CAF 24 KB
7 KB 21ms
21ms Script
text/javascript 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1256b7e2/player_ias.vflset/de_DE/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/1256b7e2/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0162754f11024315f58623795cccac1fd1c3e289d13c08ad1490b0dbaa0c65e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:29:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 148521
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7343
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 19:13:02 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 14 Sep 2022 15:29:58 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame 9CAF 4 KB
3 KB 94ms
29ms Script
text/javascript 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/1256b7e2/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="cloudview"
expires: Thu, 16 Sep 2021 08:45:19 GMT

GET
H3 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/89/ Frame 9CAF 48 KB
14 KB 49ms
21ms Script
text/javascript 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/89/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f3.1e100.net

Software

sffe /

Resource Hash

eabf87315be46a093741ed7d6a367b58627e45fbcf22505e3fa092f4dc7a4d80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 10:58:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78393
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14262
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:19:33 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 16 Sep 2021 10:58:46 GMT

GET
H/1.1 200
OK index.html Show response
sdk.scdn.co/embedded/ Frame B950 569 B
778 B 7ms
7ms Document
text/html 199.232.138.248
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.scdn.co/embedded/index.html
Requested by: Host: sdk.scdn.co
URL: https://sdk.scdn.co/spotify-player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.138.248 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1fee0b34c67a3e22047b627896862289225552817e79f658ade465b28c7103e0

Request headers

Host: sdk.scdn.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://blip.fm/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

Connection: keep-alive
Content-Length: 343
Last-Modified: Fri, 10 Sep 2021 09:54:02 GMT
ETag: "36e50209027281529c6df55c65a290e9"
Content-Type: text/html
Content-Encoding: gzip
Accept-Ranges: bytes
Date: Thu, 16 Sep 2021 08:45:20 GMT
Age: 514221
X-Served-By: cache-ord1733-ORD, cache-hhn11520-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 863
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 71 KB
25 KB 66ms
22ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: empowerlocal-plugin-js.s3.us-east-2.amazonaws.com
URL: https://empowerlocal-plugin-js.s3.us-east-2.amazonaws.com/header.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

muc03s07-in-f97.1e100.net

Software

sffe /

Resource Hash

2230f4ea5d8e1fa6a00f7257057ac0461ceac5539f4ac605ba9e638dcb7097a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "988 / 481 of 1000 / last-modified: 1631750674"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24975
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 16 Sep 2021 08:45:20 GMT

GET
H2 200 amp-ad-0.1.js Show response
cdn.ampproject.org/v0/ 71 KB
21 KB 169ms
63ms Script
text/javascript 172.217.19.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-ad-0.1.js

Requested by

Host: empowerlocal-plugin-js.s3.us-east-2.amazonaws.com
URL: https://empowerlocal-plugin-js.s3.us-east-2.amazonaws.com/header.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.19.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d3314696afdd9156dd6a16c9f5c538ef526316c81451080ecdc1ba3cddab2e5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20784
x-xss-protection: 0
server: sffe
date: Thu, 16 Sep 2021 08:45:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "6d2dec9f8c8f3593"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 16 Sep 2021 08:45:20 GMT

GET
H2 200 vue.js Show response
cdn.jsdelivr.net/npm/vue@2.x/dist/ 336 KB
89 KB 27ms
8ms Script
application/javascript 151.101.65.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2.x/dist/vue.js

Requested by

Host: empowerlocal-plugin-js.s3.us-east-2.amazonaws.com
URL: https://empowerlocal-plugin-js.s3.us-east-2.amazonaws.com/header.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

69b75483b270421e1a89426dd59387ba090772313561c3e9fa415396a78e8936

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 39432
x-jsd-version: 2.6.14
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 90557
etag: W/"53fc9-Jp9Vk24Ybv0rJ6ZZ5HLpQ6vP7ig"
x-served-by: cache-fra19131-FRA, cache-hhn4078-HHN
x-jsd-version-type: version
date: Thu, 16 Sep 2021 08:45:20 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 vuetify.js Show response
cdn.jsdelivr.net/npm/vuetify@2.x/dist/ 2 MB
256 KB 38ms
20ms Script
application/javascript 151.101.65.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vuetify@2.x/dist/vuetify.js

Requested by

Host: empowerlocal-plugin-js.s3.us-east-2.amazonaws.com
URL: https://empowerlocal-plugin-js.s3.us-east-2.amazonaws.com/header.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6dd4fff51fbb3100897e6ac0835da4e6af87ba686a9552b994a5abdfc1e95503

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 3537
x-jsd-version: 2.5.8
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 261690
etag: W/"189d04-zdvdxVDgpheWBcDq9CHpFREWgUc"
x-served-by: cache-fra19176-FRA, cache-hhn4078-HHN
x-jsd-version-type: version
date: Thu, 16 Sep 2021 08:45:20 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/250/ 353 KB
114 KB 109ms
13ms Script
application/javascript 2.21.140.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm

Requested by

Host: blip.fm
URL: https://blip.fm/_/js/base.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-21-140-111.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: "5f971164-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
cache-control: public, max-age=600
date: Thu, 16 Sep 2021 08:45:20 GMT
x-host: s7.addthis.com
content-length: 116325

GET
H/1.1 200
OK QuickSignup.26.js.jgz Show response
d1uswytv6491xe.cloudfront.net/js/ 1 KB
1 KB 10ms
10ms Script
application/x-javascript 18.66.107.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1uswytv6491xe.cloudfront.net/js/QuickSignup.26.js.jgz
Requested by: Host: blip.fm
URL: https://blip.fm/_/js/base.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.107.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3c00d50d6046dfc2e2a7de2a5a177d35e11b708fe9fc93f966c0d28a304ab485

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 12 Feb 2021 03:39:52 GMT
Content-Encoding: gzip
Age: 18680729
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 742
Last-Modified: Thu, 04 Apr 2019 15:06:32 GMT
Server: AmazonS3
ETag: "7bc3abb8437d89e80c9407562df229a6"
Content-Type: application/x-javascript
Via: 1.1 7463e2e784b132604afa3cd91a5d39a3.cloudfront.net (CloudFront)
Cache-Control: max-age=315360000
X-Amz-Cf-Pop: FRA56-P5
Accept-Ranges: bytes
X-Amz-Cf-Id: f7sznj15PeEXi7M7tF89p-L9j9f12SilIPElHa9mfLNGfBAFoS2a7A==
Expires: Thu, 04 Apr 2024 15:06:30 GMT

GET
H/1.1 200
OK profile.26.js.jgz Show response
d1uswytv6491xe.cloudfront.net/js/ 4 KB
2 KB 10ms
10ms Script
application/x-javascript 18.66.107.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1uswytv6491xe.cloudfront.net/js/profile.26.js.jgz
Requested by: Host: blip.fm
URL: https://blip.fm/_/js/base.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.107.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4b6c4dd2186139cfe5da8627cbd85b7f54e8b4d84164a4f98af88427c6ebb5e0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 10:51:59 GMT
Content-Encoding: gzip
Age: 8373202
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 1287
Last-Modified: Thu, 04 Apr 2019 15:06:42 GMT
Server: AmazonS3
ETag: "b3067d3023e15c0cfc5362eb35a1a08a"
Content-Type: application/x-javascript
Via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront)
Cache-Control: max-age=315360000
X-Amz-Cf-Pop: FRA56-P5
Accept-Ranges: bytes
X-Amz-Cf-Id: TJpQHO3tXdxQkLwFJUvM1iDrCfy7v-udZF_6yn77aoxoh_vCM1ICtg==
Expires: Thu, 04 Apr 2024 15:06:41 GMT

GET
BLOB 200
OK 53585986-efbb-4b82-83c3-287df8366b75
https://blip.fm/ 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blip.fm/53585986-efbb-4b82-83c3-287df8366b75
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame B950 48 KB
20 KB 52ms
17ms Script
text/javascript 172.217.23.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f110.1e100.net

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sdk.scdn.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 7103
date: Thu, 16 Sep 2021 06:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Thu, 16 Sep 2021 08:46:57 GMT

GET
H/1.1 200
OK index.js Show response
sdk.scdn.co/embedded/ Frame B950 628 KB
156 KB 8ms
8ms Script
application/javascript 199.232.138.248
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.scdn.co/embedded/index.js
Requested by: Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.138.248 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3b1a4a1c025813e7082240212112f092530497aac960b1d08c27db61d5a6066c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sdk.scdn.co/embedded/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:20 GMT
Content-Encoding: gzip
Last-Modified: Fri, 10 Sep 2021 09:54:02 GMT
Age: 514264
ETag: "bbb4393d7bfdf22b52deea2d42f5a8e2"
X-Served-By: cache-ord1731-ORD, cache-hhn11520-HHN
X-Cache: HIT, HIT
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 159161
X-Cache-Hits: 1, 2

GET
H2 200 pubads_impl_2021091503.js Show response
securepubads.g.doubleclick.net/gpt/ 332 KB
117 KB 86ms
31ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

sffe /

Resource Hash

e152b757baeb786f86d661804414ffcf1ea9d533aadbe4d19642c25c2d9f9cf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 118679
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 16:13:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 16 Sep 2021 08:45:20 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 120 B
752 B 87ms
32ms XHR
application/json 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=blip.fm

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

14b6bd569fe23027b2cfe5844ecb303486a2d6a129679656d3fd208cec8ad8a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Sep 2021 08:45:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95
x-xss-protection: 0
expires: Thu, 16 Sep 2021 08:45:20 GMT

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 58ms
7ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:20 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=62691
accept-ranges: bytes
content-length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/Blip.fm/ 166 B
325 B 206ms
174ms Script
application/javascript 2.21.140.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/Blip.fm/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-140-111.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4cf8b4da854cac70fb514c2d255e93904353bda1fcc7229de2f59d5971d83028

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:20 GMT
content-encoding: gzip
etag: 659743217
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=55, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 154

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 90 B
250 B 206ms
149ms Script
application/javascript 2.21.140.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=61430420fcadee59&bkl=0&bl=1&pdt=18861&sid=61430420fcadee59&pub=Blip.fm&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=blip.fm&fp=cheekcomma49&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=cheekcomma49%2Cprofile%2Cblip%2Clistener%2Cmusic%20fan%2Cdj%2Cfree%20music%2Cplaylist%2Ctracks%2Cmicroblog%2Cblips%2Clisten%2Cmp3&colc=1631781920524&jsl=4133&uvs=614304200b74f067000&skipb=1&callback=addthis.cbs.jsonp__377273290018223630
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-140-111.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 73e2f7beda739c851300b65691033bf3417451d193df1a254a6290e4521fa4e8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:20 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 90
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 4692 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html Show response
s7.addthis.com/static/ Frame C2F7 71 KB
26 KB 13ms
12ms Document
text/html 2.21.140.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-21-140-111.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

55d783462e6671fa985a6b0829db15474f4e57f0555c93e15cc2db6a1d1e6cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

server: nginx/1.15.8
content-type: text/html
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
etag: W/"5ed917ff-11adc"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 26421
date: Thu, 16 Sep 2021 08:45:20 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H2 200 / Show response
apresolve.spotify.com/ Frame B950 208 B
230 B 65ms
25ms Fetch
application/json 34.98.74.57
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by: Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.74.57 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 57.74.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 8a64e9572778a39583e0e8b4469bacb104eaa3c15fa4fdeef274492a0ba679df

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sdk.scdn.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:20 GMT
content-encoding: gzip
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=0
alt-svc: clear
content-length: 102
via: 1.1 google

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
365 B 54ms
53ms XHR
text/javascript 52.222.210.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fblip.fm%2Fcheekcomma49&pid=LjzL6afbUYkyZ&cb=0&ws=1600x1200&v=7.68.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_leaderboard%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_leaderboard%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_leaderboard%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_leaderboard%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_leaderboard%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x600%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_halfpage%22%7D%2C%7B%22sd%22%3A%226%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_mediumrectangle%22%7D%2C%7B%22sd%22%3A%227%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_mediumrectangle%22%7D%2C%7B%22sd%22%3A%228%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_mediumrectangle%22%7D%2C%7B%22sd%22%3A%229%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_mediumrectangle%22%7D%2C%7B%22sd%22%3A%2210%22%2C%22s%22%3A%5B%22336x280%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_largerectangle%22%7D%2C%7B%22sd%22%3A%2211%22%2C%22s%22%3A%5B%22336x280%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_largerectangle%22%7D%2C%7B%22sd%22%3A%2212%22%2C%22s%22%3A%5B%22336x280%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_largerectangle%22%7D%2C%7B%22sd%22%3A%2213%22%2C%22s%22%3A%5B%22336x280%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_largerectangle%22%7D%2C%7B%22sd%22%3A%2214%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_largeleaderboard%22%7D%2C%7B%22sd%22%3A%2215%22%2C%22s%22%3A%5B%22160x600%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_skyscraper%22%7D%2C%7B%22sd%22%3A%2216%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_anchor%22%7D%2C%7B%22sd%22%3A%2217%22%2C%22s%22%3A%5B%22970x250%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_superleaderboard%22%7D%2C%7B%22sd%22%3A%2218%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F12230023%2Fel_blip_leaderboardtop%22%7D%5D&pubid=434bb5e4-3704-4b75-b36c-785a444462bd&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.210.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-210-175.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:20 GMT
via: 1.1 33febf2d58aeb0618cba096d54cae019.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://blip.fm
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: gpMl7au8O08inLq-z4ubsDzIj_nc5fpwdOSkkJtWB9BLw-ppPf4Fbw==

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame B950 77 B
247 B 26ms
26ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Thu, 16 Sep 2021 08:45:20 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 79ms
26ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Sep 2021 08:45:20 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 98ms
37ms Script
application/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=blip.fm

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Sep 2021 08:45:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 87ms
33ms Script
application/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=blip.fm

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Sep 2021 08:45:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 319 KB
90 KB 782ms
753ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=41208518953562&correlator=463703405721214&output=ldjh&impl=fifs&eid=31062393%2C31062639%2C31062492%2C31062525%2C31062564%2C44748553%2C44750894&vrg=2021091503&ptt=17&sc=1&sfv=1-0-38&ecs=20210916&iu_parts=12230023%2Cel_blip_leaderboard%2Cel_blip_halfpage%2Cel_blip_mediumrectangle%2Cel_blip_largerectangle%2Cel_blip_largeleaderboard%2Cel_blip_skyscraper%2Cel_blip_anchor%2Cel_blip_superleaderboard%2Cel_blip_leaderboardtop&enc_prev_ius=%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F3%2C%2F0%2F3%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F4%2C%2F0%2F4%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2C%2F0%2F9&prev_iu_szs=728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C300x600%2C300x250%2C300x250%2C300x250%2C300x250%2C336x280%2C336x280%2C336x280%2C336x280%2C970x90%2C160x600%2C728x90%2C970x250%2C728x90&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=amznbid%3D0%26amznp%3D0&cookie_enabled=1&bc=31&arp=1&abxe=1&lmt=1631781920&dt=1631781920695&dlt=1631781917901&idt=2695&frm=20&biw=1600&bih=1200&oid=3&adxs=-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C280%2C-9%2C436%2C-9%2C-9&adys=-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C689%2C-9%2C1110%2C-9%2C-9&adks=617433239%2C617433238%2C617433233%2C617433232%2C617433235%2C4165216314%2C3598324391%2C3598324388%2C3598324389%2C3598324394%2C1974185959%2C1974185958%2C1974185957%2C1974185956%2C3076314635%2C2382161721%2C3224969948%2C553478435%2C982267445&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf%7Cg%7Ch%7Ci%7Cj&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fblip.fm%2Fcheekcomma49&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1040x0%7C0x-1%7C1600x-1%7C0x-1%7C0x-1&msz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1040x0%7C0x-1%7C1600x-1%7C0x-1%7C0x-1&ga_vid=624044984.1631781919&ga_sid=1631781919&ga_hid=1899125815&ga_fc=true&fws=2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C4%2C2%2C516%2C2%2C2&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C1040%2C0%2C1040%2C0%2C0&btvi=-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C0%7C-1%7C0%7C-1%7C-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

bccce3468ca5da547373ec18d2ce037abc6472c930ba3e55e1215a824e35ea04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:21 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92111
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-2,-1,-1,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-2,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://blip.fm
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CE75 6 KB
4 KB 124ms
21ms Document
text/html 172.217.16.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 16 Sep 2021 08:45:20 GMT
expires: Fri, 16 Sep 2022 08:45:20 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame B950 77 B
162 B 27ms
27ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Thu, 16 Sep 2021 08:45:20 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 27ms
27ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Sep 2021 08:45:20 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H3 200 container.html Show response
3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D5ED 6 KB
3 KB 36ms
14ms Document
text/html 172.217.16.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 16 Sep 2021 08:45:20 GMT
expires: Fri, 16 Sep 2022 08:45:20 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9713 6 KB
3 KB 33ms
15ms Document
text/html 172.217.16.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 16 Sep 2021 08:45:20 GMT
expires: Fri, 16 Sep 2022 08:45:20 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 68ms
47ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a97000b74006f16532e2d380cbed2e3dabd80ea9b85625fcb123d96cb9a0369a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27627
x-xss-protection: 0
server: sffe
etag: "1631705383510867"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Thu, 16 Sep 2021 08:45:21 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 96ms
37ms XHR
application/json 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021091503&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

12ed911601875ae94c43ab97f7e599d9b95295290a58344af275921643ea39ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 16 Sep 2021 08:45:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8439
x-xss-protection: 0

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame B950 77 B
162 B 28ms
27ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Thu, 16 Sep 2021 08:45:21 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 26ms
26ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Sep 2021 08:45:21 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3393 624 B
297 B 36ms
34ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNXFtsP8u-4X_iSZckh8lD-N05fLXSJuTtEO6QMR518RvfLn6ij-XyWTligTzKw5EdYeEK1MuISifXDLd6hsbThO1tSOolGLMrtW27dyP5h4GxiTcrbYXUB1VAQDiO5Tq4D33tKorccZMeU-u8gopwn7O5zPutzcpgcO8C2CPJUhmbysUfM

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNXFtsP8u-4X_iSZckh8lD-N05fLXSJuTtEO6QMR518RvfLn6ij-XyWTligTzKw5EdYeEK1MuISifXDLd6hsbThO1tSOolGLMrtW27dyP5h4GxiTcrbYXUB1VAQDiO5Tq4D33tKorccZMeU-u8gopwn7O5zPutzcpgcO8C2CPJUhmbysUfM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlKbJvoO9z3SSPSQ9l4Y4rI2QmdMUwXz5ZiI2gm4G9dCZ7_3ymzaSf5__xM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 16 Sep 2021 08:45:21 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 572E 24 KB
13 KB 55ms
53ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D-NA15Z5klPilzFus1-fIz9ypCfYvRhvuGmIMcP0h2YlmdBleKPY2ttHS463xl68UWgEg0hs4M3wW51N36tDdrxyxsuxuFp9E7fMJ_AMjp5Eqj0nI2U5l_LSkx4IEaVOlU_hKm0Xs0fWBH8O3LbP6FAqHLrQ&cry=1&dbm_d=AKAmf-CVZgluzs8xT0JW85WxT3o1NDdA-pmuJS9ex5_c0fDSF3haClSRJtC7anFppQxSNNN-xsQ63iL6XK9GqIsDUNvscMpXLBLb8Pxo4FK4qUs10AAYD4QCwg-xH6IqTxLaXmSQNLX1zIXNGOKR0j-h3XMg-XL3cAmXmlKqiHgOd9n2xyyt7Cmduz1DX86l746ik-2FI_w2j_A3BAqTf0PJA3IkOBSRdXuGRkPbZvnmjM-QuOg49-UUSDcWOzBJqLyiNzEM110UQlFxIvOcbzDi8l1JW46kOz_z-Uj8V_YOURZbSqdnPszFTl9XMqziPjFDVrUIC--Stx5DWAnHWdVCeeUI9RZ2B8elG0LNlWoGcPihkeI4NvDlv9hctvnLl7HXgNKP49hlkiojJCDxIgx_p9HymnK2vwtxQYg9ytev2XWU71PSOc2PIynZ7lC3L8ovn2cER3qFdVUcaqprlp0FlTevU02GQu_cp38JS-oMzA6_hMrsaVM-DHJYCff4G-1e28VwsrGEsSecJgXmfDIz7Tth-_n7sGo1_9KjCwvhhLnsvYH0dSGWodA-foOadxVY7wfAoWaOR15os1xB-drSxnTOPrvsV03CYRrj-Mvsv1YCCk2fD9FmHySBKit5SQQfK2Wm0eqwXtezWV5ih5rZ0GIlo5HtY1YyvwHIAoGu82dowHZm4HENxk43vHW0759v3U5doQyY92uaM5RyXQwkItNR2w6HGGeh4_m5QgSd-GpCHK9hHqgTkmlfqD00FK1nNwF78GCSA6ole-jVEfhUJwxYouIB-fJJQkAcwwFXpa4LjpncEwEQBE2ngHuc9KFwgBRCS7Un2clfpmE6R32V_okLk001NbaSqihQ4QHOKqT7TBaFfjbrq-82ksjQlYCRF2Dw0KIWKeKCen-C9cZH7FhLy8FgbeLWkfnxzouVqRsnOtxKs3ne2VOqCk9UcJ4aW3Y_onFcp-H0PoExZyBRT4Qc1Zr1bX2VdeWl7v_b6vYh9ZXMjqYow8rQSa3ePx_w1gEnw3hklPS6ur2_tAwc3qOh-E3m_U-XMxyFt08TAu5DIgQlWaZ0-R0ZlAbZyUKubLHxlzTIHqtD5XpCO8_F-dDZEKyVMwIMj3J0_Php6fjf4kTn8nhtpjFBSb6O3gy9Zm_V2ktxIyEdUS49ZUxvXpupxUy5n5j6LUjPW0waivc5mr01AAPp0H9fEH5N-DsYgwd7L2DluGg1Ptpq2SqoxBHIgtO4Kb3V-RLYU2-bDbaVW7oVoY5nT2Lv_wLLIWgHRbeND-CkyCBk2gekQ5wXI8sqYNslpyWl-fUveTARd0lCg-yW_kKuqqC_nD3euTUQr_2vPk8PLUVG9PeG3DxsLwM2OiyxV7_qkSJ5x3WybFlU2qseH9w0gew75bzNUPD5b9k2PUDR7Auk5Z9IXwFZrGirikPwVsdsIc_83uIu143Twejpm3XwiT7aFBcOuz2CIrr1RZppblo8Iwl_tH4NF0Nx7szXBrA-LwsomR7bTl5sjhaCE3OvkKW6lNdP5uLrFoWPN7AKIV5a8JANGBoughINz-g_up3hTT9Ao6BBpo4kcQGjAUpX0f1BSN3C6eZKUXFUzec7UFDPEsxwO56rznXj2Cglf4hxl4uZfX4ZiCWuy9UKx-VNV6KqVxaDXbAgt8LjSoV1Nj6PxqYDbztgK8ZGGVmiLdVpNL3uS7LMHEy0zwF5IKc2JkeH0iJ6qrpDtMJ_zPlBVwgfIKfHGda1gp4g-ne662_Js7o8uYOhNsHljWYRA5bFIytnuTu1LhWi9cl3Ot0K3C5GJ0TDSz7_BomQUhO0Evd0yCAzqlWInX36l0BFCA6bDojf11N8mrBvQeFh_H16rbucu88ABMFYvNh0u7FDyMO2NFx6CZmHDkM2teG-eIAT0rbnWu-Bze7M8BChrtrUXTDVKolLDbz02ygNIISxwboZFBC4Whh4fThHT1OFWQRAYVlDYcyFuc9BTQ8_ZBO2YOuQyViKIAw81V7KNR1CfP4aH5Jktw0ddsaXiclpZgOqDvLXKqE24Kjit5e1JN_2sVBijOB1LL9HcvWM1Vs6wVP3isWvmA7hQW2BhlFzoAiL3hfVOfseVTeZhVbhKPRO7ONsFmWZx9mBZmYQlRPb_nX5JV1AmG5P2P75ct1PmyKnILL2J8BgFTknBo0MKFeR3e0U1muBTREjOQORW5pM4cHjrbzphkBhvPJzsvghhMxLC4rbEY2tRU-2UsQRFpdr3vKeopu_GrRCJUBx3R1fn0lfVVOJQjNsjOTVOfwUnz9UaeKIrD-wzBigh7IBmEDv0XqAXs13ycpuI-HOGh0EaGDXyNqN_dYeLgaHIDwjNIGk8qIVzE97ISUY7jA8M0cvNxe9dF5_zIfGh26ulB41SV9z4yRU9UtdinyyOYhNWJFKuY3sXM3KurKqSBWt3DG6hk1Mh6_fhN_ORchDCl3CAGIA7bFmhH0wAsX4MgXCaKNMwkjoHkv5E2jarM6I8LNAGEV7tY0wgSsaQx7TS7wqALJAyESl3dZyMRVsneXeVXIUcUAF7Mp8x3xTzRBGtWVhFnCTixs1VK9TtX0fgc5XpDXUPvGv3bE4WrQB3PBwH9rfoJ4SjSP0sINtWkmC13q5pI-GdDm_PdUFnLJspMHjnLSR2-iQlrVZ5ZIjF79Kts0NzLRsA-xgoFI9lscpAQgtoT7QZdPTIWgnAlk148WM74Qym3XxuhRuLCsGqKEkjdIz1gW2rQjtneAXJ62vEtsQjNdYYKqZhe8TGgtcz__H3bOyUc8kiWX0ClfO2sA-__F-VUEpbSAta9mFIyjmkdcspJfdtbOEZargp7Lekhsux_PXsQk8-gP3Nq6KLkOBnHporZdVU7yLU6RNelR9joBj1-UGkanx5kX9Z7WMkCFsKd-nsrvxRXl1jPk1qPuy3qpQ0wHBY-Jl7mcPkKDYD3i19YFaEyTtcXgI0ETqmyUI0w9tZhyQh9zmVWbwKrk68cL4h0uXm19cukBOA3rTlMOuHLd51bl-FURbYBe-Jp9teA6P2QvoEDC6tCGJgv1DhDc&cid=CAASEuRo1Zyy0XB5_UdE33Cd9sk91g&rfl=2%2Chttps%253A%252F%252Fblip.fm%252F%240

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7168283df602d75ea63ba97d39e151296d0a0f3e228bc88a382ca133a10668fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12869
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210914/r20110914/client/ Frame 572E 2 KB
1 KB 53ms
16ms Script
text/javascript 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210914/r20110914/client/window_focus_fy2019.js

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Sep 2021 08:45:02 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 572E 128 KB
39 KB 2991ms
2990ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc8bce6b98f344ceb503d0c7c623ecf395808995efd843d616c3e7ab401a116f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39459
x-xss-protection: 0
server: sffe
etag: "1631705359914318"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Thu, 16 Sep 2021 08:45:24 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210914/r20110914/client/ Frame 572E 14 KB
7 KB 48ms
13ms Script
text/javascript 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210914/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:44:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Sep 2021 08:44:32 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 572E 42 B
515 B 80ms
29ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BHpOVePiN9dL2z4bqE-2XjOTnUwdy7XzH800gmEWqwd1xtjF_eBUQSq4dm06AErsQtUFTvh1N4VPYTLnAsW9-WuJD7Fa1DY9PsShNf2hrJeyNdNUA

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EF45 640 B
316 B 36ms
35ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNVW6tcxnVzUHKk7u6yC-1jL4H3Ktj9N2zNkrSoiRJTxnUTOvtBuS33LPZ0ipngYgZqcLV1Fu7skxpoPDMvQ0HhFLcoLqObRAQcW3HsUyvayunpohPlNq9amp4vXgDDjWzsp4uBUkVOvHw5tYPBFXsKUC6Svu117RwmdFO6czA2-JZKq8Bw

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNVW6tcxnVzUHKk7u6yC-1jL4H3Ktj9N2zNkrSoiRJTxnUTOvtBuS33LPZ0ipngYgZqcLV1Fu7skxpoPDMvQ0HhFLcoLqObRAQcW3HsUyvayunpohPlNq9amp4vXgDDjWzsp4uBUkVOvHw5tYPBFXsKUC6Svu117RwmdFO6czA2-JZKq8Bw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlKbJvoO9z3SSPSQ9l4Y4rI2QmdMUwXz5ZiI2gm4G9dCZ7_3ymzaSf5__xM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 16 Sep 2021 08:45:21 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9713 24 KB
13 KB 57ms
56ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dphg092r7K8DFdaw5poVQZCQNCNepuZ42u00aWtpI8PvgasCWfSQ18kDNbzymGvzfJX-GekaDFSb8vRxNZhqEgsxqyVs4NMaF7qBnAU8tyr0D0KXeXDLzb3n6f1xn7ST5YsAnCkk16oKYHW1tpC6kWWTadKg&cry=1&dbm_d=AKAmf-AsjuOGSxL6cNb40cHbFeVr_wtbo-bkWTfmSZCdMKx7lqqARKQSdrFnL3xhUt7CgbGyCdPhKu2j313KyAculLd5wQz81-RlDhjpGLDLgGMERIoFn-cxC8GYOgkeYj_RVd09DlvKwiOxpRe6pvWChSEoD-E0RS1DbU7RJBUzdgSnsIcL-jv_TAs1uOyaCZ7wAuBeneynACvUi4SFgYM_gfaaj6wcQk2O1Mqcb-fGHU4Dh8pU9Po4KCbpn5icDwoEWSzExYA5X6sNgf-okFHAzgeY_7hpcCNUm_zXIw6GFtYxKEQxgVElYGTLDG_hzONp4-eroXGzcJwMHZzpsUu6VS63AHEjEdmOU15XsToTUri3fzO45azrkTmHD5DuJfpjwjUk6o8aAN09gUM9owSoWtoea-TJgjLkr5UIUi_O5bzySXyz_4-yD9kHsDES76GaWfwJruPk0L0pUGTXvnmf46H8YL6yRcrnjTuGMfh77tSKuSO6dtTnYzw60f6EhPgnFjcYqgkhdq8Ft1lIl4PXchLb2AXnB9LKrk9JTaOUC-jnkvcu8u3Uw4JJ02BMU7qgkACzySbqkAWo4vqA1_0VIuw4tjKCkpOFUGL_khxB5QGE3Y8lR-OOk4tYBbM05tfyPW3rjOfDkFhm0elsOnIuve0ifgaGzubLYeN_7gTSUb_G_-TiY5CmPw2EW7p36Q_FGXS2RQF5JOTB9n1Prt1m8pi9mLC9nItOlQZJ6GFHi69sE7fLVBddDjGrsh-gswsE4C88n8B2qOC0ycot8glJEEvxOEa3vwFA1EPIaHcQCaPvBg_GEoTRkKdHTz0XryKHsMrsCp_cX3DwnfoJF7PgLLbdG9HvwmXVxUqG8E-CiuIha2DRCSD4bDohsifAN68FxtytsEOyLgLF30ijnAxFtIhhM5hfm23nwjrbGdGBzJmXO8WM4BV5LOxtUFnrooSEj2SZY_3IsjSSBWDt7lwTp6KMiXKPdx1dbghX41iPOpwjpYU4gl4bwiNNnFQeUPDtnopxmjjLthgQyDueTGU10VNZDPBHDphK6vX08cxSpajUJkCLvzRqCpxZf_h0ZgaSfP2En5eInzN4-ooIY-uYH9ZfDlLVRpgdbq-GXBb5rlNGYIe_yEanKpSY4pa3MgQ0IMuRemNhBb1XxJpkIQYlaXGAHOJhKEq7nwwC-b5Qnk3ON9T_2dzgnc9WqKhRom0leiK9QqAoG_hk47NFhF7yr576odLIR_E4pj6BtnX8XA8d3vqX76kTKxwVpSIbFf78SGTfbzmXAEkTgRe8RbZ1laizO8jbkUVyd56Xutjsvgdj2FBNkDkBgsXMWREpZt1FAwKfAgQoaZmAMp4o4We_ujRopMPIJBrg9YNKwcWpSnW_EAc5G8ZSJ0x5OvNVwHlTUzPSWczyo9RQuC8E7mSN832Ubh-jiYYGzGrnYkTx3i5xmM5vcMQ46KSf24FL7ZWNvQIm4-i7_K5I4Hzi6HROH_8zVOFY2jrtl0giuqz5Klc-CupUpnuaXJ0FbBo8hrRIHMwE-oBwCUcDWp69VhXExE7BsWLpLohCYutCOrpRWl6urjxjHbNzbBdJumXuKerPMm9OdfKmkYbXv07o08hhiCVHkGD0xDX7CEXBe2LewmrJMK1oVSPU6d-IJHOh-JjLnQjv_rCRykWTdYm55wGMSHuOTVP4I-bGaUnpbpRnwjy3anV81UgSK7GA3PM3daLD7bcDUYUJJHIhp5u6JwUzm1efg1ApFnGAfTZ0TdgojlYkHFEmtc-WtgK82sDc8LX-QUiM8mpt_1vLXRA69r49sOm49y4cvVamixGyj4d7IpaGlOPJ0IpJcWCYR5-W2-WYUGMzmWoRKnbTHekHlLJuZa06mmvOWZ601UstlB7cvDq1MyWoYoz2lZwuxKojVmJEWRubQuQ5K1uGzaDYAbmdLzFvL2lbi35wfy9Ekmo0KNSh73qHEBAGgvP0sVh8tmW0LVAhRqyyKixBsiRzs_Tyx4-Q4S2LlSykkLwzBKZTXcVpv33N9Q-NpgjN_wxSh_8j0fKM5J894bT5QQsYIoX8fcRU-du7_1Xq0H3z-ycEJB2e3bnx8PwLdCmtKEseMov4JPzB0fZC4n1qUbpQ4uDtSwfvN2Yp1LGfD5pwS-R5R620ctV7SexoANv8DVyrv7RHr0E_cLJHky2NwMK1Hk0IJZYNU3cZ6xWmgQE-1fx6gv-mtTMUAxLMX_fCExEiwCADPMmaOqwhvO-vBwxXIbENvwV3uux1qPCff86PFJ3OfVJzQfp2Lyc8i1rKS682Pdk5bLmsrO7o8qQVk0RW9TAguOK-1U9B4oiJWN--AKPOzUxHZawGq16msDUXg7IwybKMnEWKQraQoEByg6rrcDOg4hMxAjT7EZ01ry-w8lITsFttydY8OZuc_hhrY6ZAACnvJvBn2jcyazTYum0e5VrGAmjBsshS6bhXInR-0zAm1aV3iIYQ33Ko7eb6DjrjG7Vl_mPOZ2n_-NDHXOavyDr1uybh-IEDp1hQE5xrj18YVNKv24nkID_ISkuJvDjKyDWdUNWghoa1_AiYPq-7L0C7Y9B9970-Uhq05tZGc2k_l54uvTu-vyEzCfy1ZTLMXF5H2RCTDp09ApnBTFhMAPWDVOE7DRRAm3sieXW7QwFrla39xwtKeEDOKdoC72usWgeNiHNdswuYsLtDV2VPRh-zj_3DD2BbGlqRPwrjrAhhRQw7K_9jqpL2ab6pqXZjHKoGrF7ce8mL7cNJCMe-GkdvwNyBT6xNyZepnoP9NAotTqizViMzqzNZ9YwS4oh_Msd-iTqsBkEcRABc-Td3ptxvLg9UtoQyEfQ9aHUCj5i0R8U8fYSiigDHx3BnvZ4yX9MTwzZKxSdR8JhOMsYy1agGnsNaEoSpZKuoWaH_8-rLGPYDuE75zDg8vRPf2hD1peY8fvqQMMGkyanj3sdZ2xwDxU-mSzVzU6jmx7IuR8uMj1TXXd9p5oo1xAK8E8D7vg1FIJwyst_IH5_kSB5OtYDGMyQszZ1KvjphorFy4aow5RXNbJvESCA&cid=CAASEuRoFJ1VVmzvu5lk7LvMNtD6LQ&rfl=1%2Chttps%253A%252F%252Fblip.fm%252F%240

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35e63dcf18811507adb340bb2cae4b15b30e1dac105129910e0cc3e6b4c3c43d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12995
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9713 42 B
107 B 94ms
44ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CG_VO0DRm-q-6Es0oepquD4LFrEtfoxy28TlAOuLB2qMiQ7DPRuJ3GzBVpsgPHWh_4kdhYqucL-5YhKpV_edA9M9oc_3lBkQVwdjhz--gJxU2_mOk

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210914/r20110914/client/ Frame 9713 2 KB
1 KB 58ms
24ms Script
text/javascript 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210914/r20110914/client/window_focus_fy2019.js

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Sep 2021 08:45:02 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9713 128 KB
39 KB 3011ms
3011ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc8bce6b98f344ceb503d0c7c623ecf395808995efd843d616c3e7ab401a116f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39459
x-xss-protection: 0
server: sffe
etag: "1631705359914318"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Thu, 16 Sep 2021 08:45:24 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210914/r20110914/client/ Frame 9713 14 KB
6 KB 48ms
15ms Script
text/javascript 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210914/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:44:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Sep 2021 08:44:32 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 60ms
34ms Script
text/javascript 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 16 Sep 2021 08:45:21 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210913/r20110914/ Frame 572E 23 KB
9 KB 59ms
23ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210913/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D-NA15Z5klPilzFus1-fIz9ypCfYvRhvuGmIMcP0h2YlmdBleKPY2ttHS463xl68UWgEg0hs4M3wW51N36tDdrxyxsuxuFp9E7fMJ_AMjp5Eqj0nI2U5l_LSkx4IEaVOlU_hKm0Xs0fWBH8O3LbP6FAqHLrQ&cry=1&dbm_d=AKAmf-CVZgluzs8xT0JW85WxT3o1NDdA-pmuJS9ex5_c0fDSF3haClSRJtC7anFppQxSNNN-xsQ63iL6XK9GqIsDUNvscMpXLBLb8Pxo4FK4qUs10AAYD4QCwg-xH6IqTxLaXmSQNLX1zIXNGOKR0j-h3XMg-XL3cAmXmlKqiHgOd9n2xyyt7Cmduz1DX86l746ik-2FI_w2j_A3BAqTf0PJA3IkOBSRdXuGRkPbZvnmjM-QuOg49-UUSDcWOzBJqLyiNzEM110UQlFxIvOcbzDi8l1JW46kOz_z-Uj8V_YOURZbSqdnPszFTl9XMqziPjFDVrUIC--Stx5DWAnHWdVCeeUI9RZ2B8elG0LNlWoGcPihkeI4NvDlv9hctvnLl7HXgNKP49hlkiojJCDxIgx_p9HymnK2vwtxQYg9ytev2XWU71PSOc2PIynZ7lC3L8ovn2cER3qFdVUcaqprlp0FlTevU02GQu_cp38JS-oMzA6_hMrsaVM-DHJYCff4G-1e28VwsrGEsSecJgXmfDIz7Tth-_n7sGo1_9KjCwvhhLnsvYH0dSGWodA-foOadxVY7wfAoWaOR15os1xB-drSxnTOPrvsV03CYRrj-Mvsv1YCCk2fD9FmHySBKit5SQQfK2Wm0eqwXtezWV5ih5rZ0GIlo5HtY1YyvwHIAoGu82dowHZm4HENxk43vHW0759v3U5doQyY92uaM5RyXQwkItNR2w6HGGeh4_m5QgSd-GpCHK9hHqgTkmlfqD00FK1nNwF78GCSA6ole-jVEfhUJwxYouIB-fJJQkAcwwFXpa4LjpncEwEQBE2ngHuc9KFwgBRCS7Un2clfpmE6R32V_okLk001NbaSqihQ4QHOKqT7TBaFfjbrq-82ksjQlYCRF2Dw0KIWKeKCen-C9cZH7FhLy8FgbeLWkfnxzouVqRsnOtxKs3ne2VOqCk9UcJ4aW3Y_onFcp-H0PoExZyBRT4Qc1Zr1bX2VdeWl7v_b6vYh9ZXMjqYow8rQSa3ePx_w1gEnw3hklPS6ur2_tAwc3qOh-E3m_U-XMxyFt08TAu5DIgQlWaZ0-R0ZlAbZyUKubLHxlzTIHqtD5XpCO8_F-dDZEKyVMwIMj3J0_Php6fjf4kTn8nhtpjFBSb6O3gy9Zm_V2ktxIyEdUS49ZUxvXpupxUy5n5j6LUjPW0waivc5mr01AAPp0H9fEH5N-DsYgwd7L2DluGg1Ptpq2SqoxBHIgtO4Kb3V-RLYU2-bDbaVW7oVoY5nT2Lv_wLLIWgHRbeND-CkyCBk2gekQ5wXI8sqYNslpyWl-fUveTARd0lCg-yW_kKuqqC_nD3euTUQr_2vPk8PLUVG9PeG3DxsLwM2OiyxV7_qkSJ5x3WybFlU2qseH9w0gew75bzNUPD5b9k2PUDR7Auk5Z9IXwFZrGirikPwVsdsIc_83uIu143Twejpm3XwiT7aFBcOuz2CIrr1RZppblo8Iwl_tH4NF0Nx7szXBrA-LwsomR7bTl5sjhaCE3OvkKW6lNdP5uLrFoWPN7AKIV5a8JANGBoughINz-g_up3hTT9Ao6BBpo4kcQGjAUpX0f1BSN3C6eZKUXFUzec7UFDPEsxwO56rznXj2Cglf4hxl4uZfX4ZiCWuy9UKx-VNV6KqVxaDXbAgt8LjSoV1Nj6PxqYDbztgK8ZGGVmiLdVpNL3uS7LMHEy0zwF5IKc2JkeH0iJ6qrpDtMJ_zPlBVwgfIKfHGda1gp4g-ne662_Js7o8uYOhNsHljWYRA5bFIytnuTu1LhWi9cl3Ot0K3C5GJ0TDSz7_BomQUhO0Evd0yCAzqlWInX36l0BFCA6bDojf11N8mrBvQeFh_H16rbucu88ABMFYvNh0u7FDyMO2NFx6CZmHDkM2teG-eIAT0rbnWu-Bze7M8BChrtrUXTDVKolLDbz02ygNIISxwboZFBC4Whh4fThHT1OFWQRAYVlDYcyFuc9BTQ8_ZBO2YOuQyViKIAw81V7KNR1CfP4aH5Jktw0ddsaXiclpZgOqDvLXKqE24Kjit5e1JN_2sVBijOB1LL9HcvWM1Vs6wVP3isWvmA7hQW2BhlFzoAiL3hfVOfseVTeZhVbhKPRO7ONsFmWZx9mBZmYQlRPb_nX5JV1AmG5P2P75ct1PmyKnILL2J8BgFTknBo0MKFeR3e0U1muBTREjOQORW5pM4cHjrbzphkBhvPJzsvghhMxLC4rbEY2tRU-2UsQRFpdr3vKeopu_GrRCJUBx3R1fn0lfVVOJQjNsjOTVOfwUnz9UaeKIrD-wzBigh7IBmEDv0XqAXs13ycpuI-HOGh0EaGDXyNqN_dYeLgaHIDwjNIGk8qIVzE97ISUY7jA8M0cvNxe9dF5_zIfGh26ulB41SV9z4yRU9UtdinyyOYhNWJFKuY3sXM3KurKqSBWt3DG6hk1Mh6_fhN_ORchDCl3CAGIA7bFmhH0wAsX4MgXCaKNMwkjoHkv5E2jarM6I8LNAGEV7tY0wgSsaQx7TS7wqALJAyESl3dZyMRVsneXeVXIUcUAF7Mp8x3xTzRBGtWVhFnCTixs1VK9TtX0fgc5XpDXUPvGv3bE4WrQB3PBwH9rfoJ4SjSP0sINtWkmC13q5pI-GdDm_PdUFnLJspMHjnLSR2-iQlrVZ5ZIjF79Kts0NzLRsA-xgoFI9lscpAQgtoT7QZdPTIWgnAlk148WM74Qym3XxuhRuLCsGqKEkjdIz1gW2rQjtneAXJ62vEtsQjNdYYKqZhe8TGgtcz__H3bOyUc8kiWX0ClfO2sA-__F-VUEpbSAta9mFIyjmkdcspJfdtbOEZargp7Lekhsux_PXsQk8-gP3Nq6KLkOBnHporZdVU7yLU6RNelR9joBj1-UGkanx5kX9Z7WMkCFsKd-nsrvxRXl1jPk1qPuy3qpQ0wHBY-Jl7mcPkKDYD3i19YFaEyTtcXgI0ETqmyUI0w9tZhyQh9zmVWbwKrk68cL4h0uXm19cukBOA3rTlMOuHLd51bl-FURbYBe-Jp9teA6P2QvoEDC6tCGJgv1DhDc&cid=CAASEuRo1Zyy0XB5_UdE33Cd9sk91g&rfl=2%2Chttps%253A%252F%252Fblip.fm%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

574d0f8eeef6741771d3cef0cc4869634263181bbf42de1e93ca22dcae36d8e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 468
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9215
x-xss-protection: 0
server: cafe
etag: 10665788317172091938
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Sep 2021 08:37:33 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 572E 41 KB
15 KB 35ms
19ms Script
text/javascript 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

824.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 14:29:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 152153
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Sep 2022 14:29:28 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3393
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAfK1WWOFuzFEPX2BKBMtgE&google_cver=1

43 B
1014 B

35ms
24ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAfK1WWOFuzFEPX2BKBMtgE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNXFtsP8u-4X_iSZckh8lD-N05fLXSJuTtEO6QMR518RvfLn6ij-XyWTligTzKw5EdYeEK1MuISifXDLd6hsbThO1tSOolGLMrtW27dyP5h4GxiTcrbYXUB1VAQDiO5Tq4D33tKorccZMeU-u8gopwn7O5zPutzcpgcO8C2CPJUhmbysUfM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:21 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 16 Sep 2021 08:45:21 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAfK1WWOFuzFEPX2BKBMtgE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3393
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUMEIZLI7xinGwcoitvTWQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAfK1WWOFuzFEPX2BKBMtgE&google_cver=1

43 B
894 B

20ms
20ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAfK1WWOFuzFEPX2BKBMtgE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNXFtsP8u-4X_iSZckh8lD-N05fLXSJuTtEO6QMR518RvfLn6ij-XyWTligTzKw5EdYeEK1MuISifXDLd6hsbThO1tSOolGLMrtW27dyP5h4GxiTcrbYXUB1VAQDiO5Tq4D33tKorccZMeU-u8gopwn7O5zPutzcpgcO8C2CPJUhmbysUfM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:21 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 16 Sep 2021 08:45:21 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAfK1WWOFuzFEPX2BKBMtgE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3393
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKioo0d-VO8vUiNEwkbzXVA&google_cver=1

0
580 B

35ms
33ms

Image
text/html

185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEKioo0d-VO8vUiNEwkbzXVA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNXFtsP8u-4X_iSZckh8lD-N05fLXSJuTtEO6QMR518RvfLn6ij-XyWTligTzKw5EdYeEK1MuISifXDLd6hsbThO1tSOolGLMrtW27dyP5h4GxiTcrbYXUB1VAQDiO5Tq4D33tKorccZMeU-u8gopwn7O5zPutzcpgcO8C2CPJUhmbysUfM

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:21 GMT
X-Proxy-Origin: 216.131.111.168; 216.131.111.168; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 853be413-9267-4853-a2a2-68d25d4f9eac
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEKioo0d-VO8vUiNEwkbzXVA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3393
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDAxMDI3MTgyODMxMzg4Mw%3D%3D

170 B
188 B

73ms
42ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDAxMDI3MTgyODMxMzg4Mw%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:21 GMT
X-Proxy-Origin: 216.131.111.168; 216.131.111.168; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 023227e6-395c-4e22-b088-089ea0bb57fe
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDAxMDI3MTgyODMxMzg4Mw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame EF45
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGt-xegSUZttXJok-8Wrqbg&google_cver=1

43 B
172 B

21ms
21ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGt-xegSUZttXJok-8Wrqbg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNVW6tcxnVzUHKk7u6yC-1jL4H3Ktj9N2zNkrSoiRJTxnUTOvtBuS33LPZ0ipngYgZqcLV1Fu7skxpoPDMvQ0HhFLcoLqObRAQcW3HsUyvayunpohPlNq9amp4vXgDDjWzsp4uBUkVOvHw5tYPBFXsKUC6Svu117RwmdFO6czA2-JZKq8Bw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.216.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
via: 1.1 google
server: OXGW/16.216.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGt-xegSUZttXJok-8Wrqbg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame EF45
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTVlMTdkMmYtMDFkMC0yZTA4LWVhNTEtYjdlMjk4MjkzODBi

170 B
243 B

32ms
31ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTVlMTdkMmYtMDFkMC0yZTA4LWVhNTEtYjdlMjk4MjkzODBi

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNVW6tcxnVzUHKk7u6yC-1jL4H3Ktj9N2zNkrSoiRJTxnUTOvtBuS33LPZ0ipngYgZqcLV1Fu7skxpoPDMvQ0HhFLcoLqObRAQcW3HsUyvayunpohPlNq9amp4vXgDDjWzsp4uBUkVOvHw5tYPBFXsKUC6Svu117RwmdFO6czA2-JZKq8Bw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 16 Sep 2021 08:45:21 GMT
content-encoding: gzip
server: OXGW/16.216.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTVlMTdkMmYtMDFkMC0yZTA4LWVhNTEtYjdlMjk4MjkzODBi
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame EF45
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEEI6OV5dZ2ZDl5YG4PSqZp8&google_cver=1

23 B
172 B

137ms
36ms

Image
image/gif

104.90.104.248
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEEI6OV5dZ2ZDl5YG4PSqZp8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNVW6tcxnVzUHKk7u6yC-1jL4H3Ktj9N2zNkrSoiRJTxnUTOvtBuS33LPZ0ipngYgZqcLV1Fu7skxpoPDMvQ0HhFLcoLqObRAQcW3HsUyvayunpohPlNq9amp4vXgDDjWzsp4uBUkVOvHw5tYPBFXsKUC6Svu117RwmdFO6czA2-JZKq8Bw
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.104.248 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-104-248.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 16 Sep 2021 08:45:21 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEEI6OV5dZ2ZDl5YG4PSqZp8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame EF45 23 B
172 B 235ms
35ms Image
image/gif 104.90.104.248
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNVW6tcxnVzUHKk7u6yC-1jL4H3Ktj9N2zNkrSoiRJTxnUTOvtBuS33LPZ0ipngYgZqcLV1Fu7skxpoPDMvQ0HhFLcoLqObRAQcW3HsUyvayunpohPlNq9amp4vXgDDjWzsp4uBUkVOvHw5tYPBFXsKUC6Svu117RwmdFO6czA2-JZKq8Bw
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.104.248 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-104-248.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:21 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 16 Sep 2021 08:45:21 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210913/r20110914/ Frame 9713 23 KB
9 KB 51ms
20ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210913/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dphg092r7K8DFdaw5poVQZCQNCNepuZ42u00aWtpI8PvgasCWfSQ18kDNbzymGvzfJX-GekaDFSb8vRxNZhqEgsxqyVs4NMaF7qBnAU8tyr0D0KXeXDLzb3n6f1xn7ST5YsAnCkk16oKYHW1tpC6kWWTadKg&cry=1&dbm_d=AKAmf-AsjuOGSxL6cNb40cHbFeVr_wtbo-bkWTfmSZCdMKx7lqqARKQSdrFnL3xhUt7CgbGyCdPhKu2j313KyAculLd5wQz81-RlDhjpGLDLgGMERIoFn-cxC8GYOgkeYj_RVd09DlvKwiOxpRe6pvWChSEoD-E0RS1DbU7RJBUzdgSnsIcL-jv_TAs1uOyaCZ7wAuBeneynACvUi4SFgYM_gfaaj6wcQk2O1Mqcb-fGHU4Dh8pU9Po4KCbpn5icDwoEWSzExYA5X6sNgf-okFHAzgeY_7hpcCNUm_zXIw6GFtYxKEQxgVElYGTLDG_hzONp4-eroXGzcJwMHZzpsUu6VS63AHEjEdmOU15XsToTUri3fzO45azrkTmHD5DuJfpjwjUk6o8aAN09gUM9owSoWtoea-TJgjLkr5UIUi_O5bzySXyz_4-yD9kHsDES76GaWfwJruPk0L0pUGTXvnmf46H8YL6yRcrnjTuGMfh77tSKuSO6dtTnYzw60f6EhPgnFjcYqgkhdq8Ft1lIl4PXchLb2AXnB9LKrk9JTaOUC-jnkvcu8u3Uw4JJ02BMU7qgkACzySbqkAWo4vqA1_0VIuw4tjKCkpOFUGL_khxB5QGE3Y8lR-OOk4tYBbM05tfyPW3rjOfDkFhm0elsOnIuve0ifgaGzubLYeN_7gTSUb_G_-TiY5CmPw2EW7p36Q_FGXS2RQF5JOTB9n1Prt1m8pi9mLC9nItOlQZJ6GFHi69sE7fLVBddDjGrsh-gswsE4C88n8B2qOC0ycot8glJEEvxOEa3vwFA1EPIaHcQCaPvBg_GEoTRkKdHTz0XryKHsMrsCp_cX3DwnfoJF7PgLLbdG9HvwmXVxUqG8E-CiuIha2DRCSD4bDohsifAN68FxtytsEOyLgLF30ijnAxFtIhhM5hfm23nwjrbGdGBzJmXO8WM4BV5LOxtUFnrooSEj2SZY_3IsjSSBWDt7lwTp6KMiXKPdx1dbghX41iPOpwjpYU4gl4bwiNNnFQeUPDtnopxmjjLthgQyDueTGU10VNZDPBHDphK6vX08cxSpajUJkCLvzRqCpxZf_h0ZgaSfP2En5eInzN4-ooIY-uYH9ZfDlLVRpgdbq-GXBb5rlNGYIe_yEanKpSY4pa3MgQ0IMuRemNhBb1XxJpkIQYlaXGAHOJhKEq7nwwC-b5Qnk3ON9T_2dzgnc9WqKhRom0leiK9QqAoG_hk47NFhF7yr576odLIR_E4pj6BtnX8XA8d3vqX76kTKxwVpSIbFf78SGTfbzmXAEkTgRe8RbZ1laizO8jbkUVyd56Xutjsvgdj2FBNkDkBgsXMWREpZt1FAwKfAgQoaZmAMp4o4We_ujRopMPIJBrg9YNKwcWpSnW_EAc5G8ZSJ0x5OvNVwHlTUzPSWczyo9RQuC8E7mSN832Ubh-jiYYGzGrnYkTx3i5xmM5vcMQ46KSf24FL7ZWNvQIm4-i7_K5I4Hzi6HROH_8zVOFY2jrtl0giuqz5Klc-CupUpnuaXJ0FbBo8hrRIHMwE-oBwCUcDWp69VhXExE7BsWLpLohCYutCOrpRWl6urjxjHbNzbBdJumXuKerPMm9OdfKmkYbXv07o08hhiCVHkGD0xDX7CEXBe2LewmrJMK1oVSPU6d-IJHOh-JjLnQjv_rCRykWTdYm55wGMSHuOTVP4I-bGaUnpbpRnwjy3anV81UgSK7GA3PM3daLD7bcDUYUJJHIhp5u6JwUzm1efg1ApFnGAfTZ0TdgojlYkHFEmtc-WtgK82sDc8LX-QUiM8mpt_1vLXRA69r49sOm49y4cvVamixGyj4d7IpaGlOPJ0IpJcWCYR5-W2-WYUGMzmWoRKnbTHekHlLJuZa06mmvOWZ601UstlB7cvDq1MyWoYoz2lZwuxKojVmJEWRubQuQ5K1uGzaDYAbmdLzFvL2lbi35wfy9Ekmo0KNSh73qHEBAGgvP0sVh8tmW0LVAhRqyyKixBsiRzs_Tyx4-Q4S2LlSykkLwzBKZTXcVpv33N9Q-NpgjN_wxSh_8j0fKM5J894bT5QQsYIoX8fcRU-du7_1Xq0H3z-ycEJB2e3bnx8PwLdCmtKEseMov4JPzB0fZC4n1qUbpQ4uDtSwfvN2Yp1LGfD5pwS-R5R620ctV7SexoANv8DVyrv7RHr0E_cLJHky2NwMK1Hk0IJZYNU3cZ6xWmgQE-1fx6gv-mtTMUAxLMX_fCExEiwCADPMmaOqwhvO-vBwxXIbENvwV3uux1qPCff86PFJ3OfVJzQfp2Lyc8i1rKS682Pdk5bLmsrO7o8qQVk0RW9TAguOK-1U9B4oiJWN--AKPOzUxHZawGq16msDUXg7IwybKMnEWKQraQoEByg6rrcDOg4hMxAjT7EZ01ry-w8lITsFttydY8OZuc_hhrY6ZAACnvJvBn2jcyazTYum0e5VrGAmjBsshS6bhXInR-0zAm1aV3iIYQ33Ko7eb6DjrjG7Vl_mPOZ2n_-NDHXOavyDr1uybh-IEDp1hQE5xrj18YVNKv24nkID_ISkuJvDjKyDWdUNWghoa1_AiYPq-7L0C7Y9B9970-Uhq05tZGc2k_l54uvTu-vyEzCfy1ZTLMXF5H2RCTDp09ApnBTFhMAPWDVOE7DRRAm3sieXW7QwFrla39xwtKeEDOKdoC72usWgeNiHNdswuYsLtDV2VPRh-zj_3DD2BbGlqRPwrjrAhhRQw7K_9jqpL2ab6pqXZjHKoGrF7ce8mL7cNJCMe-GkdvwNyBT6xNyZepnoP9NAotTqizViMzqzNZ9YwS4oh_Msd-iTqsBkEcRABc-Td3ptxvLg9UtoQyEfQ9aHUCj5i0R8U8fYSiigDHx3BnvZ4yX9MTwzZKxSdR8JhOMsYy1agGnsNaEoSpZKuoWaH_8-rLGPYDuE75zDg8vRPf2hD1peY8fvqQMMGkyanj3sdZ2xwDxU-mSzVzU6jmx7IuR8uMj1TXXd9p5oo1xAK8E8D7vg1FIJwyst_IH5_kSB5OtYDGMyQszZ1KvjphorFy4aow5RXNbJvESCA&cid=CAASEuRoFJ1VVmzvu5lk7LvMNtD6LQ&rfl=1%2Chttps%253A%252F%252Fblip.fm%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

574d0f8eeef6741771d3cef0cc4869634263181bbf42de1e93ca22dcae36d8e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 468
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9215
x-xss-protection: 0
server: cafe
etag: 10665788317172091938
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 30 Sep 2021 08:37:33 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9713 41 KB
15 KB 31ms
19ms Script
text/javascript 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 14:29:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 152153
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Sep 2022 14:29:28 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E853 22 KB
8 KB 17ms
17ms Document
text/html 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 14 Sep 2021 14:29:29 GMT
expires: Wed, 14 Sep 2022 14:29:29 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 152152
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FB7D 22 KB
8 KB 17ms
16ms Document
text/html 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 14 Sep 2021 14:29:29 GMT
expires: Wed, 14 Sep 2022 14:29:29 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 152152
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 049C 12 KB
5 KB 16ms
16ms Document
text/html 216.58.212.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.129 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Thu, 16 Sep 2021 07:21:59 GMT
expires: Fri, 16 Sep 2022 07:21:59 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 5002
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 3468 783 B
1 KB 87ms
34ms Document
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f4.1e100.net

Software

GSE /

Resource Hash

712c4572778a4dee23199565cb0063a9076ade4de2f517a4b078d2bd6c310ef6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-XpBCVs1UjPyDvmuwz0li7g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

expires: Thu, 16 Sep 2021 08:45:21 GMT
date: Thu, 16 Sep 2021 08:45:21 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-XpBCVs1UjPyDvmuwz0li7g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame 9CAF 28 B
54 B 37ms
37ms XHR
application/json 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/1256b7e2/www-embed-player.vflset/www-embed-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 0
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
X-YouTube-Client-Version: 1.20210913.1.0
X-YouTube-Time-Zone: Etc/Unknown
X-Goog-Visitor-Id: CgtBamxDbEE2a0F4QSifiIyKBg%3D%3D
X-YouTube-Ad-Signals: dt=1631781919355&flash=0&frm=2&u_tz&u_his=2&u_java&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C320%2C270&vis=1&wgl=true&ca_type=image&bid=ANyPxKok2NnSiH2i_zQf-SschKP3oYV2yzYqfoisXQ5Kx3qtPwVkzLUa51MPsZwFojqvO370I6QMNUGCHQepFjkFBKjySYKYDA

Response headers

date: Thu, 16 Sep 2021 08:45:21 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Thu, 16 Sep 2021 08:45:21 GMT

GET
H/1.1 200
OK k87fl8jofdhz Show response
hal9000.redintelligence.net/zone/ Frame 572E 11 KB
4 KB 48ms
12ms Script
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/k87fl8jofdhz?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCIhbpIARDYaGyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9DCtnk0rm_qPMwYkoioTmXoXAP8IH5QYuiWGkPoZXL1s1Nw6Fb58GSoTVSg2LFD-BwJK5bGzdE--Y3cZbAF2HGIHCDG42kTctDxuKFmF_CZE1VIOYmE6K4rv6mDg_RC8jhEHPDphgaIFZksPextt3Q_G-dwXyQSctetwEcRNkyHg8lrmSXSk5Np2z7g2G6x5-tQWfce7Lnt3SvEW1aIYdc_zwDXSOgzgcAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRo1Zyy0XB5_UdE33Cd9sk91g%26sig%3DAOD64_2L-2Q-QE0_CBxw0FSn-DBrkLF8yw%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-Dr-l-hhMcN8YUzTItW1pDTRjnOuHQRp2zAn_xzcRD6DmwiFG0-sxbuCOj95ACVZwLTi64P0aDSLQmy_u2baU58ce_3BfPf-1Q04vLkAVtBmOK7XEVx2N7vZgehO1uuzt4xCmFN6bMhr0YHye085BALdgnPYw%26cry%3D1%26dbm_d%3DAKAmf-Asimj05By_i6nHxD519z_p4uJUJVmisWyParhEXYR_gSk5VeEmbQa1L26R-8-4N7-2y3aJgdgrjIdKFXGZ4XitnIp5o2y7FZKocwHWQqsGDJqNKFGr7lkSbc0ulj-9Udw6MzxUUZ_ETek1zgeNInuE3Oh_1YGqPtBhBE0DzuAH_1pqUxQb8bg89BxG6y-SwHa3vy8w0A5WFsD5KRbKOIsp-Fp9jMPey8CP4npy-m1qCNMK7PrPMWGvn73tn746KYT9aofErGh8cLRmc7bT6r2zGmqqsC2HLQiVfDZtEok3Pk8vdgCgH7EZyThhHbEgpo82ugMx7-pzk8nTpT1m1FDyfISqBX-nVrIVQUec9K007IrCVSllROfSyUt5nP5_HRyZVM4BymiyT_wy58jtGMtVtetPxkEOJ9rmoJvcZZ1zkCV5bIp9GSNR8n-NFk_BMsfM3CMv%26adurl%3D
Requested by: Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 31acc8fe2d5e602c0399c3db1a188dd9644c889b9d0a208d4ae60e0680414f95

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:21 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3862
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK k87fl8jofdhz Show response
hal9000.redintelligence.net/zone/ Frame 9713 11 KB
4 KB 35ms
12ms Script
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/k87fl8jofdhz?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCRGIuIARDYaKyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9BeLJaTAEeI5ywQPeFcFqA0jSJJ6EDr0ZATDI_4ZEknZbJic3hhLj2SuDpg5x2c-59dYOaFY0mcJhk2q0tyCwLOTCqKLL7ynX1QqvGGLTbjR0J5zgjOBpsz-IL3hNLXEfMo657kH1YIdpxxTB1BGBxX1dOLEGd80KIAJg-ZoxZ-nhesZOGxbeEdt0WcaqUaDwDm9C8Z6TfP1TfKwSBTzskQFA1u0JOHqsAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoFJ1VVmzvu5lk7LvMNtD6LQ%26sig%3DAOD64_0fabCNG320Sfl0E5xSt2iaAtn3nA%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-DCl8hoZGvL1pOCsX_nshp5G7pXGjAuDSRxLjeXxCleji2BUl63eBNRjJ16bi_SAcBXG95a_LjBXV5r64YJdDNskHXDgvdckH_xARhBp67OAXU3KIwZyaxuaY0iOjVvPed_Z-v2p9oKICmm4r0x42ABfmxOrg%26cry%3D1%26dbm_d%3DAKAmf-A2FpZm9UCzwl70PMJjqu8OSVzVLeEe1OERiO-SCXJ4AmLgMasMcNNLYEEASkmLpD8IkkbeMT9EvCCgmfyJzbmzrqq9jcFmwEKTZLXr_83e27bIjuXovBNaMOEo16Etw8CxLPZ3NPqVRwiZUiyZwtIRuz5TRFF2fgjhnmARxbrkN4LiDR_RBAqExUcovfSzkNQJBN1mc0IO2wH_zXoV0weziJWQyT4ZcW1jDKFYQuv_b7xs42WkT3HzIY1XGRzOKZ0IOZm8jYqdKa1TlvGSy9C6kFKpDpTaudls-BhGl7QmvfWCdy8Ri0aGNaGjzdI9mOLxPbrm-slnZzEJi5HFuS0Rh5XLH8h1I0AIguXAg35Aj-J240m5OlgdPA_gWF1eeiXJkvqxPywGjqoAGpZO5dg9G6XYFHsSiSnNASvPfX8d-NZC5lAFZLQLzF_KUDaajyxCg-qk%26adurl%3D
Requested by: Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: ca4ac4999e7e7b764ed5b736987717dee538da6b4b4337328679cef9ea800699

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:21 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3861
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 XcVhRkqPIT2L3eK0A2yH-xZ56-A5-6Pxm_m8s2he-Ag.js Show response
pagead2.googlesyndication.com/bg/ Frame E853 35 KB
13 KB 21ms
21ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XcVhRkqPIT2L3eK0A2yH-xZ56-A5-6Pxm_m8s2he-Ag.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5dc561464a8f213d8bdde2b4036c87fb1679ebe039fba3f19bf9bcb3685ef808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 19:26:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 134309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13291
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 14:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 14 Sep 2022 19:26:52 GMT

GET
H3 200 XcVhRkqPIT2L3eK0A2yH-xZ56-A5-6Pxm_m8s2he-Ag.js Show response
pagead2.googlesyndication.com/bg/ Frame FB7D 35 KB
13 KB 21ms
21ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XcVhRkqPIT2L3eK0A2yH-xZ56-A5-6Pxm_m8s2he-Ag.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5dc561464a8f213d8bdde2b4036c87fb1679ebe039fba3f19bf9bcb3685ef808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 19:26:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 134309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13291
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 14:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 14 Sep 2022 19:26:52 GMT

GET
H3 200 XcVhRkqPIT2L3eK0A2yH-xZ56-A5-6Pxm_m8s2he-Ag.js Show response
pagead2.googlesyndication.com/bg/ Frame 049C 35 KB
13 KB 27ms
26ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/XcVhRkqPIT2L3eK0A2yH-xZ56-A5-6Pxm_m8s2he-Ag.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

sffe /

Resource Hash

5dc561464a8f213d8bdde2b4036c87fb1679ebe039fba3f19bf9bcb3685ef808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 19:26:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 134309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13291
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 14:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 14 Sep 2022 19:26:52 GMT

GET
H/1.1

200
OK

request.php Show response
hal900014.redintelligence.net/ Frame 572E
Redirect Chain

https://hal900014.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=a1d1a91aac&subid=&uid=5cfb712e182fd8a1&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900014.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=a1d1a91aac&subid=&uid=5cfb712e182fd8a1&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

752ms
729ms

Script
application/x-javascript

176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=a1d1a91aac&subid=&uid=5cfb712e182fd8a1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCIhbpIARDYaGyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9DCtnk0rm_qPMwYkoioTmXoXAP8IH5QYuiWGkPoZXL1s1Nw6Fb58GSoTVSg2LFD-BwJK5bGzdE--Y3cZbAF2HGIHCDG42kTctDxuKFmF_CZE1VIOYmE6K4rv6mDg_RC8jhEHPDphgaIFZksPextt3Q_G-dwXyQSctetwEcRNkyHg8lrmSXSk5Np2z7g2G6x5-tQWfce7Lnt3SvEW1aIYdc_zwDXSOgzgcAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRo1Zyy0XB5_UdE33Cd9sk91g%26sig%3DAOD64_2L-2Q-QE0_CBxw0FSn-DBrkLF8yw%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-Dr-l-hhMcN8YUzTItW1pDTRjnOuHQRp2zAn_xzcRD6DmwiFG0-sxbuCOj95ACVZwLTi64P0aDSLQmy_u2baU58ce_3BfPf-1Q04vLkAVtBmOK7XEVx2N7vZgehO1uuzt4xCmFN6bMhr0YHye085BALdgnPYw%26cry%3D1%26dbm_d%3DAKAmf-Asimj05By_i6nHxD519z_p4uJUJVmisWyParhEXYR_gSk5VeEmbQa1L26R-8-4N7-2y3aJgdgrjIdKFXGZ4XitnIp5o2y7FZKocwHWQqsGDJqNKFGr7lkSbc0ulj-9Udw6MzxUUZ_ETek1zgeNInuE3Oh_1YGqPtBhBE0DzuAH_1pqUxQb8bg89BxG6y-SwHa3vy8w0A5WFsD5KRbKOIsp-Fp9jMPey8CP4npy-m1qCNMK7PrPMWGvn73tn746KYT9aofErGh8cLRmc7bT6r2zGmqqsC2HLQiVfDZtEok3Pk8vdgCgH7EZyThhHbEgpo82ugMx7-pzk8nTpT1m1FDyfISqBX-nVrIVQUec9K007IrCVSllROfSyUt5nP5_HRyZVM4BymiyT_wy58jtGMtVtetPxkEOJ9rmoJvcZZ1zkCV5bIp9GSNR8n-NFk_BMsfM3CMv%26adurl%3D&documentReferer=https%3A%2F%2F3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2F3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fblip.fm&random=2072622204492&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: bb91c62008d2d3e5d65f1d0875aaa514382c2aa12949ee9f5aeb8f868ead9f83

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:21 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 52448400055849800710580011719014
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1104
Expires: Thu, 16 Sep 2021 09:45:21 +0200

Redirect headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:21 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=a1d1a91aac&subid=&uid=5cfb712e182fd8a1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCIhbpIARDYaGyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9DCtnk0rm_qPMwYkoioTmXoXAP8IH5QYuiWGkPoZXL1s1Nw6Fb58GSoTVSg2LFD-BwJK5bGzdE--Y3cZbAF2HGIHCDG42kTctDxuKFmF_CZE1VIOYmE6K4rv6mDg_RC8jhEHPDphgaIFZksPextt3Q_G-dwXyQSctetwEcRNkyHg8lrmSXSk5Np2z7g2G6x5-tQWfce7Lnt3SvEW1aIYdc_zwDXSOgzgcAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRo1Zyy0XB5_UdE33Cd9sk91g%26sig%3DAOD64_2L-2Q-QE0_CBxw0FSn-DBrkLF8yw%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-Dr-l-hhMcN8YUzTItW1pDTRjnOuHQRp2zAn_xzcRD6DmwiFG0-sxbuCOj95ACVZwLTi64P0aDSLQmy_u2baU58ce_3BfPf-1Q04vLkAVtBmOK7XEVx2N7vZgehO1uuzt4xCmFN6bMhr0YHye085BALdgnPYw%26cry%3D1%26dbm_d%3DAKAmf-Asimj05By_i6nHxD519z_p4uJUJVmisWyParhEXYR_gSk5VeEmbQa1L26R-8-4N7-2y3aJgdgrjIdKFXGZ4XitnIp5o2y7FZKocwHWQqsGDJqNKFGr7lkSbc0ulj-9Udw6MzxUUZ_ETek1zgeNInuE3Oh_1YGqPtBhBE0DzuAH_1pqUxQb8bg89BxG6y-SwHa3vy8w0A5WFsD5KRbKOIsp-Fp9jMPey8CP4npy-m1qCNMK7PrPMWGvn73tn746KYT9aofErGh8cLRmc7bT6r2zGmqqsC2HLQiVfDZtEok3Pk8vdgCgH7EZyThhHbEgpo82ugMx7-pzk8nTpT1m1FDyfISqBX-nVrIVQUec9K007IrCVSllROfSyUt5nP5_HRyZVM4BymiyT_wy58jtGMtVtetPxkEOJ9rmoJvcZZ1zkCV5bIp9GSNR8n-NFk_BMsfM3CMv%26adurl%3D&documentReferer=https%3A%2F%2F3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2F3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fblip.fm&random=2072622204492&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Thu, 16 Sep 2021 09:45:21 +0200

GET
H/1.1

200
OK

request.php Show response
hal900026.redintelligence.net/ Frame 9713
Redirect Chain

https://hal900026.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=919aad4f5a&subid=&uid=a7234a409ced9e2a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900026.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=919aad4f5a&subid=&uid=a7234a409ced9e2a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

107ms
82ms

Script
application/x-javascript

138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900026.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=919aad4f5a&subid=&uid=a7234a409ced9e2a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCRGIuIARDYaKyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9BeLJaTAEeI5ywQPeFcFqA0jSJJ6EDr0ZATDI_4ZEknZbJic3hhLj2SuDpg5x2c-59dYOaFY0mcJhk2q0tyCwLOTCqKLL7ynX1QqvGGLTbjR0J5zgjOBpsz-IL3hNLXEfMo657kH1YIdpxxTB1BGBxX1dOLEGd80KIAJg-ZoxZ-nhesZOGxbeEdt0WcaqUaDwDm9C8Z6TfP1TfKwSBTzskQFA1u0JOHqsAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoFJ1VVmzvu5lk7LvMNtD6LQ%26sig%3DAOD64_0fabCNG320Sfl0E5xSt2iaAtn3nA%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-DCl8hoZGvL1pOCsX_nshp5G7pXGjAuDSRxLjeXxCleji2BUl63eBNRjJ16bi_SAcBXG95a_LjBXV5r64YJdDNskHXDgvdckH_xARhBp67OAXU3KIwZyaxuaY0iOjVvPed_Z-v2p9oKICmm4r0x42ABfmxOrg%26cry%3D1%26dbm_d%3DAKAmf-A2FpZm9UCzwl70PMJjqu8OSVzVLeEe1OERiO-SCXJ4AmLgMasMcNNLYEEASkmLpD8IkkbeMT9EvCCgmfyJzbmzrqq9jcFmwEKTZLXr_83e27bIjuXovBNaMOEo16Etw8CxLPZ3NPqVRwiZUiyZwtIRuz5TRFF2fgjhnmARxbrkN4LiDR_RBAqExUcovfSzkNQJBN1mc0IO2wH_zXoV0weziJWQyT4ZcW1jDKFYQuv_b7xs42WkT3HzIY1XGRzOKZ0IOZm8jYqdKa1TlvGSy9C6kFKpDpTaudls-BhGl7QmvfWCdy8Ri0aGNaGjzdI9mOLxPbrm-slnZzEJi5HFuS0Rh5XLH8h1I0AIguXAg35Aj-J240m5OlgdPA_gWF1eeiXJkvqxPywGjqoAGpZO5dg9G6XYFHsSiSnNASvPfX8d-NZC5lAFZLQLzF_KUDaajyxCg-qk%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=8185745905111&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a470591186222a70583f2bc5ebb33a16a709d0df165ec4222e5eb3d115aa0b15

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:21 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 98785200072947400710580011719026
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1098
Expires: Thu, 16 Sep 2021 09:45:21 +0200

Redirect headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:21 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=919aad4f5a&subid=&uid=a7234a409ced9e2a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCRGIuIARDYaKyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9BeLJaTAEeI5ywQPeFcFqA0jSJJ6EDr0ZATDI_4ZEknZbJic3hhLj2SuDpg5x2c-59dYOaFY0mcJhk2q0tyCwLOTCqKLL7ynX1QqvGGLTbjR0J5zgjOBpsz-IL3hNLXEfMo657kH1YIdpxxTB1BGBxX1dOLEGd80KIAJg-ZoxZ-nhesZOGxbeEdt0WcaqUaDwDm9C8Z6TfP1TfKwSBTzskQFA1u0JOHqsAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoFJ1VVmzvu5lk7LvMNtD6LQ%26sig%3DAOD64_0fabCNG320Sfl0E5xSt2iaAtn3nA%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-DCl8hoZGvL1pOCsX_nshp5G7pXGjAuDSRxLjeXxCleji2BUl63eBNRjJ16bi_SAcBXG95a_LjBXV5r64YJdDNskHXDgvdckH_xARhBp67OAXU3KIwZyaxuaY0iOjVvPed_Z-v2p9oKICmm4r0x42ABfmxOrg%26cry%3D1%26dbm_d%3DAKAmf-A2FpZm9UCzwl70PMJjqu8OSVzVLeEe1OERiO-SCXJ4AmLgMasMcNNLYEEASkmLpD8IkkbeMT9EvCCgmfyJzbmzrqq9jcFmwEKTZLXr_83e27bIjuXovBNaMOEo16Etw8CxLPZ3NPqVRwiZUiyZwtIRuz5TRFF2fgjhnmARxbrkN4LiDR_RBAqExUcovfSzkNQJBN1mc0IO2wH_zXoV0weziJWQyT4ZcW1jDKFYQuv_b7xs42WkT3HzIY1XGRzOKZ0IOZm8jYqdKa1TlvGSy9C6kFKpDpTaudls-BhGl7QmvfWCdy8Ri0aGNaGjzdI9mOLxPbrm-slnZzEJi5HFuS0Rh5XLH8h1I0AIguXAg35Aj-J240m5OlgdPA_gWF1eeiXJkvqxPywGjqoAGpZO5dg9G6XYFHsSiSnNASvPfX8d-NZC5lAFZLQLzF_KUDaajyxCg-qk%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=8185745905111&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Thu, 16 Sep 2021 09:45:21 +0200

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 3468 0
0 45ms
45ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021091503&jk=41208518953562&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame E780
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=98785200072947400710580011719026&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=98785200072947400710580011719026&actionid=879111&produktid=ratenkredit&dt_url=

0
607 B

65ms
26ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=98785200072947400710580011719026&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=919aad4f5a&subid=&uid=a7234a409ced9e2a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCRGIuIARDYaKyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9BeLJaTAEeI5ywQPeFcFqA0jSJJ6EDr0ZATDI_4ZEknZbJic3hhLj2SuDpg5x2c-59dYOaFY0mcJhk2q0tyCwLOTCqKLL7ynX1QqvGGLTbjR0J5zgjOBpsz-IL3hNLXEfMo657kH1YIdpxxTB1BGBxX1dOLEGd80KIAJg-ZoxZ-nhesZOGxbeEdt0WcaqUaDwDm9C8Z6TfP1TfKwSBTzskQFA1u0JOHqsAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoFJ1VVmzvu5lk7LvMNtD6LQ%26sig%3DAOD64_0fabCNG320Sfl0E5xSt2iaAtn3nA%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-DCl8hoZGvL1pOCsX_nshp5G7pXGjAuDSRxLjeXxCleji2BUl63eBNRjJ16bi_SAcBXG95a_LjBXV5r64YJdDNskHXDgvdckH_xARhBp67OAXU3KIwZyaxuaY0iOjVvPed_Z-v2p9oKICmm4r0x42ABfmxOrg%26cry%3D1%26dbm_d%3DAKAmf-A2FpZm9UCzwl70PMJjqu8OSVzVLeEe1OERiO-SCXJ4AmLgMasMcNNLYEEASkmLpD8IkkbeMT9EvCCgmfyJzbmzrqq9jcFmwEKTZLXr_83e27bIjuXovBNaMOEo16Etw8CxLPZ3NPqVRwiZUiyZwtIRuz5TRFF2fgjhnmARxbrkN4LiDR_RBAqExUcovfSzkNQJBN1mc0IO2wH_zXoV0weziJWQyT4ZcW1jDKFYQuv_b7xs42WkT3HzIY1XGRzOKZ0IOZm8jYqdKa1TlvGSy9C6kFKpDpTaudls-BhGl7QmvfWCdy8Ri0aGNaGjzdI9mOLxPbrm-slnZzEJi5HFuS0Rh5XLH8h1I0AIguXAg35Aj-J240m5OlgdPA_gWF1eeiXJkvqxPywGjqoAGpZO5dg9G6XYFHsSiSnNASvPfX8d-NZC5lAFZLQLzF_KUDaajyxCg-qk%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=8185745905111&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: pb.media01.eu
:scheme: https
:path: /view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=98785200072947400710580011719026&actionid=879111&produktid=ratenkredit&dt_url=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 16 Sep 2021 10:45:22 GMT
server: Microsoft-IIS/10.0
set-cookie: ASP.NET_SessionId=yjkuv54aa1efhclzqqhp2eop; path=/; secure; HttpOnly DTU=72502E6A4ADED13235A8EEEC5F5AAF2E; expires=Sat, 16-Sep-2023 08:45:22 GMT; path=/; SameSite=None; secure; HttpOnly
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
access-control-allow-origin: *
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Thu, 16 Sep 2021 08:45:21 GMT
content-length: 0

Redirect headers

Server: nginx/1.17.5
Date: Thu, 16 Sep 2021 08:45:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Keep-Alive: timeout=20
X-Powered-By: PHP/7.2.21
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Range, Content-Disposition, Content-Type, Authorization
Access-Control-Allow-Credentials: true
Set-Cookie: trscj=MTYzMTc4MTkyMnxMM1J5WTJzdlpYQjJMMlU1T1dGaFkyVTVOR1UyWlRVNE56TTRPREZrTXpRd01EazVNMlV4WlRkbFAzTjFZbWxrUFRrNE56ZzFNakF3TURjeU9UUTNOREF3TnpFd05UZ3dNREV4TnpFNU1ESTJKblE5YUhSc2NBPT18YUhSMGNITTZMeTh6WldNMVl6Z3pZelUxTWpNM01ETmxaVEF4WXpSbFpUTTNNRGMwTldaak5DNXpZV1psWm5KaGJXVXVaMjl2WjJ4bGMzbHVaR2xqWVhScGIyNHVZMjl0THc9PQ%3D%3D; expires=Fri, 16-Sep-2022 08:45:22 GMT; Max-Age=31536000; path=/; samesite=none; domain=.medialead.de; secure SERVERID177589=1|YUMEJ|YUMEJ; path=/; HttpOnly
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=98785200072947400710580011719026&actionid=879111&produktid=ratenkredit&dt_url=
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload max-age=15768000
X-IPLB-Request-ID: D8836FA8:DD14_91EFC182:01BB_61430422_7A4576F:2667E
X-IPLB-Instance: 40028
Cache-control: private

GET
H3

200

activityi;dc_pre=CJ-Ryq6Ng_MCFQevUQod860PDA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4731447349104.531 Show response
5994599.fls.doubleclick.net/ Frame A0F8
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4731447349104.531?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CJ-Ryq6Ng_MCFQevUQod860PDA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4731447349104.531?

391 B
344 B

66ms
39ms

Document
text/html

142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CJ-Ryq6Ng_MCFQevUQod860PDA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4731447349104.531?

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

85041691bbb543470bd090fec845cc274235495aa9119668a2a38a7bd63bce1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CJ-Ryq6Ng_MCFQevUQod860PDA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4731447349104.531?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlKbJvoO9z3SSPSQ9l4Y4rI2QmdMUwXz5ZiI2gm4G9dCZ7_3ymzaSf5__xM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 16 Sep 2021 08:45:22 GMT
expires: Thu, 16 Sep 2021 08:45:22 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 321
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 16 Sep 2021 08:45:22 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJ-Ryq6Ng_MCFQevUQod860PDA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4731447349104.531?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900026.redintelligence.net/ Frame 9C02 7 KB
2 KB 39ms
15ms Document
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900026.redintelligence.net/request_content.php?s=98785200072947400710580011719026&a=bd47fe28
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=919aad4f5a&subid=&uid=a7234a409ced9e2a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCRGIuIARDYaKyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9BeLJaTAEeI5ywQPeFcFqA0jSJJ6EDr0ZATDI_4ZEknZbJic3hhLj2SuDpg5x2c-59dYOaFY0mcJhk2q0tyCwLOTCqKLL7ynX1QqvGGLTbjR0J5zgjOBpsz-IL3hNLXEfMo657kH1YIdpxxTB1BGBxX1dOLEGd80KIAJg-ZoxZ-nhesZOGxbeEdt0WcaqUaDwDm9C8Z6TfP1TfKwSBTzskQFA1u0JOHqsAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRoFJ1VVmzvu5lk7LvMNtD6LQ%26sig%3DAOD64_0fabCNG320Sfl0E5xSt2iaAtn3nA%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-DCl8hoZGvL1pOCsX_nshp5G7pXGjAuDSRxLjeXxCleji2BUl63eBNRjJ16bi_SAcBXG95a_LjBXV5r64YJdDNskHXDgvdckH_xARhBp67OAXU3KIwZyaxuaY0iOjVvPed_Z-v2p9oKICmm4r0x42ABfmxOrg%26cry%3D1%26dbm_d%3DAKAmf-A2FpZm9UCzwl70PMJjqu8OSVzVLeEe1OERiO-SCXJ4AmLgMasMcNNLYEEASkmLpD8IkkbeMT9EvCCgmfyJzbmzrqq9jcFmwEKTZLXr_83e27bIjuXovBNaMOEo16Etw8CxLPZ3NPqVRwiZUiyZwtIRuz5TRFF2fgjhnmARxbrkN4LiDR_RBAqExUcovfSzkNQJBN1mc0IO2wH_zXoV0weziJWQyT4ZcW1jDKFYQuv_b7xs42WkT3HzIY1XGRzOKZ0IOZm8jYqdKa1TlvGSy9C6kFKpDpTaudls-BhGl7QmvfWCdy8Ri0aGNaGjzdI9mOLxPbrm-slnZzEJi5HFuS0Rh5XLH8h1I0AIguXAg35Aj-J240m5OlgdPA_gWF1eeiXJkvqxPywGjqoAGpZO5dg9G6XYFHsSiSnNASvPfX8d-NZC5lAFZLQLzF_KUDaajyxCg-qk%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=8185745905111&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b782beade41095bf937cddd9f9445bb0514da511e10e2bf29c659f343ef80da9

Request headers

Host: hal900026.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=5423a7650f19d014
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 16 Sep 2021 09:45:22 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2053
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 9713
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=98785200072947400710580011719026
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=98785200072947400710580011719026
https://ad-server.eu/wm/pb/native.png

68 B
312 B

165ms
29ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:48:41 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: nginx/1.17.5
X-IPLB-Request-ID: D8836FA8:DD14_91EFC182:01BB_61430422_7A45774:2667E
X-Powered-By: PHP/7.2.21
X-IPLB-Instance: 40028
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload, max-age=15768000
Content-Type: text/html; charset=UTF-8
Location: https://ad-server.eu/wm/pb/native.png
Cache-control: private
Transfer-Encoding: chunked
Keep-Alive: timeout=20

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 9713 43 B
704 B 152ms
32ms Image
image/gif 104.92.94.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2601049&v=18332&q=376776&r=296283&pref1=98785200072947400710580011719026&pv=1

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.94.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:22 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 9713 43 B
704 B 151ms
31ms Image
image/gif 104.92.94.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2338577&v=11830&q=357066&r=296283&pref1=98785200072947400710580011719026&pv=1

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.94.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:22 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 644D 1 KB
749 B 22ms
22ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 15 Sep 2021 08:58:57 GMT
expires: Thu, 16 Sep 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
cache-control: public, max-age=86400
age: 85585
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E853 0
20 B 32ms
32ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BY4DaIQRDYZCjJ_Sox_APq6aEoA0AAAAAOAHgBAI&bg=!o6CloOTNAAaUnz4elJ87ACkAdvg8WjyHCTe8Fw1JcMXk9N3eiYeEweCL7yPQGWYY62Ht3Ov0cpiAqwIAAADTUgAAACtoAQeZAwEw8McdymmDuK2WCu6yMn-IgFpn6xDNmP32r53nd36pQ7IL3kKuGwAEoe5LDowPzKgFXhfnGP9ZzSYDDL3LUcro7gFnfN1k3ZdQ9RA6THg130fGjQHJGzH8E37VCXyTtNb7skHmkp6wNkwHOKpKVSRn75wvvhEHisIY83ZFsZ23zQRBcSobG7dXnUd0t4lHK1x0i1F9opUVabnjuyrAAduuBIcyIvZL_57sO1IeBDeFciH1__ACSXSHmpC7xkPatT55Rw0RrLzxzA6GyKdvhPA9nSXmrJw5pbigmGG92s48K6CLoNrijKlStdJh2S_qmkDr5u3mZxmCzB16DpBEBHiFTrmFVPkhtPDV_QvQfPd4oj60JF40X3P1AmnDi9wFo7xRgQY-Ji9e6M29uJnsuCYN1e4_kZsYPrkO1GcRa0ix7IKxo1onlOgGvCINL4uupJ-tATbXIE-JhX6vxq5qAvVrKEPeNs17cFaDCLPAtMDufLXyy0WZdr2_FBavjauk-KHdfuzjD9OIs6pq4HXY1lVr_xI1Me08kKAPMtpZDupCml95BVVyppn5HqmIqmNwrpTz24I2_xvhGjbcCEbht1m-A0DAmXaxaKKZFPr5jpwFSsMyCTrfputiia1FH4qwfIJtjhAjgrkjmTL6tWIXeDebCPZvDMajAGPN9mKCtXEvR8WfY2pTKjQU5D124T21tc08nilSxSFV4esGstKAPytbVDfm93H4mqRWxQvg_frjfxBd_zKctlGU11bfBlyVUNr1-Ku4gJxi_og-EsY70AqI9qLgbw60OanA8GHRUgF62Bb_Fo6F-rLocHtJgXRHS-do1E5rv29xgiQBA7gKg-F0B-0xBoEfTkGOaOLcLAiZA5DQMzaHp_pyvozKtnJcOOkJ85WnYK9tVx9bqHzAdKlIuxm2oZS_3zOPHeQInAr2YG4w1l_a7L0ZA-0J3RqGEFrQzxNx2GkNfemhQwdKb-bqf9Ibd_xSnv6U4O3Y_B57SWcaaY86BXK5KJAg_hmywuvq

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f10.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9C02 1 KB
418 B 60ms
32ms Stylesheet
text/css 142.250.184.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=98785200072947400710580011719026&a=bd47fe28

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9c1521286e7dd2d6f8c2262b15bca8867bcae973a83879accdd00e1cb9831e5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 08:30:02 GMT
server: ESF
date: Thu, 16 Sep 2021 08:45:22 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 16 Sep 2021 08:45:22 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9C02 16 KB
16 KB 35ms
13ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=98785200072947400710580011719026&a=bd47fe28
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 7a4ae6019a9a05d3522ab45d8fc04b5c889c87af9fe23f4e023313d212bd6610

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16247
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9C02 15 KB
15 KB 34ms
12ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52343/creativesup/1200x627_2.jpg
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=98785200072947400710580011719026&a=bd47fe28
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 6153a3fab9985cf016adadf717935658544342f3dba2bc85855dac6158b0d6ea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15250
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9C02 14 KB
14 KB 35ms
13ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/32783/creativesup/native_ad_globus_baumarkt_1200x627.jpg
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=98785200072947400710580011719026&a=bd47fe28
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 4b8524dcf65dbdd20638c7da046e47d59368d6f926f6a39b8891923cc55b8f95

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 14131
Vary: Accept-Encoding
Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 644D
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEBMxeEvltTM9KC5t-LXHsGQ&google_cver=1&google_push=AYg5qPL6S0Gu8whDdVzArPO6uYY5C7bf_gAK_J_YKLJDSbCaukzy4lDS8FuCptWfKBY5HGv2-j-nAHAJnJ7ofrPnDTX27AvFvMRb
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjQ0ODA5MDQ0NDM1ODYwMDA0Nw==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEBMxeEvltTM9KC5t-LXHsGQ&google_cver=1

43 B
407 B

38ms
14ms

Image
image/gif

46.228.164.11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEBMxeEvltTM9KC5t-LXHsGQ&google_cver=1
Requested by: Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.228.164.11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEBMxeEvltTM9KC5t-LXHsGQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET /
dsp.adfarm1.adition.com/cookie/ Frame 644D 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 644D
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEEeLl2TJat0hQTu6MYO_zjU&google_cver=1&google_push=AYg5qPJMiuUxbRmdELqH7H0J3keDeELj2Kr9Y0Zm1j5CQtUGXZBL9rX2E5_fpTQcQVuz8_bf5duK479X...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEEeLl2TJat0hQTu6MYO_zjU&google_cver=1&google_push=AYg5qPJMiuUxbRmdELqH7H0J3keDeELj2Kr9Y0Zm1j5CQtUGXZBL9rX2E5_fpTQcQVuz8_bf5du...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzE3NDE0NjgyNjA4MzA1NjMxNA&google_push=AYg5qPJMiuUxbRmdELqH7H0J3keDeELj2Kr9Y0Zm1j5CQtUGXZBL9rX2E5_fpTQcQVuz8_bf5duK47...

170 B
188 B

37ms
37ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzE3NDE0NjgyNjA4MzA1NjMxNA&google_push=AYg5qPJMiuUxbRmdELqH7H0J3keDeELj2Kr9Y0Zm1j5CQtUGXZBL9rX2E5_fpTQcQVuz8_bf5duK479Xc6Opa4ui38BjHjxwaJ4

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzE3NDE0NjgyNjA4MzA1NjMxNA&google_push=AYg5qPJMiuUxbRmdELqH7H0J3keDeELj2Kr9Y0Zm1j5CQtUGXZBL9rX2E5_fpTQcQVuz8_bf5duK479Xc6Opa4ui38BjHjxwaJ4
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 644D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBnJaNisVdHafqQ1unYADWg&google_cver=1&google_push=AYg5qPI3Y4XQxc4_6eGtnJqxciEjrCNBgB5Me_JamK45cwqydCb7RjJDta6CHu2O909JFWaIhKK...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RNT1RQQk4tMU8tQ0FCQQ==&google_push=AYg5qPI3Y4XQxc4_6eGtnJqxciEjrCNBgB5Me_JamK45cwqydCb7RjJDta6CHu2O909JFWaIhKKR5fU2s3LSoJdnTaAPggmt0eaq

170 B
188 B

37ms
37ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RNT1RQQk4tMU8tQ0FCQQ==&google_push=AYg5qPI3Y4XQxc4_6eGtnJqxciEjrCNBgB5Me_JamK45cwqydCb7RjJDta6CHu2O909JFWaIhKKR5fU2s3LSoJdnTaAPggmt0eaq

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RNT1RQQk4tMU8tQ0FCQQ==&google_push=AYg5qPI3Y4XQxc4_6eGtnJqxciEjrCNBgB5Me_JamK45cwqydCb7RjJDta6CHu2O909JFWaIhKKR5fU2s3LSoJdnTaAPggmt0eaq
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 644D
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEJY6OA3lx0IiZieHPZQScj4&google_cver=1&google_push=AYg5qPIg2oB6UNOVPDMVN72-G8qIyJ4X_IpEFxfpbWwl3qn4KPodkpuOr3UGT_JzTHUaz477PG3BVpuHlH_ifkRqF...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEJY6OA3lx0IiZieHPZQScj4&google_cver=1&google_push=AYg5qPIg2oB6UNOVPDMVN72-G8qIyJ4X_IpEFxfpbWwl3qn4KPodkpuOr3UGT_JzTHUaz477PG3BVpuHlH_ifkRqF...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIg2oB6UNOVPDMVN72-G8qIyJ4X_IpEFxfpbWwl3qn4KPodkpuOr3UGT_JzTHUaz477PG3BVpuHlH_ifkRqFfsSckt_hCgf&google_hm=d79f38653204ea81462bcc7b

170 B
188 B

37ms
37ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIg2oB6UNOVPDMVN72-G8qIyJ4X_IpEFxfpbWwl3qn4KPodkpuOr3UGT_JzTHUaz477PG3BVpuHlH_ifkRqFfsSckt_hCgf&google_hm=d79f38653204ea81462bcc7b

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIg2oB6UNOVPDMVN72-G8qIyJ4X_IpEFxfpbWwl3qn4KPodkpuOr3UGT_JzTHUaz477PG3BVpuHlH_ifkRqFfsSckt_hCgf&google_hm=d79f38653204ea81462bcc7b
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 644D
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEA...
https://sync.targeting.unrulymedia.com/csync/RX-3fa84b2f-6021-4243-abdc-11fb9d0a66c7-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPJypGwO_M2LXek0xa5ME...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJypGwO_M2LXek0xa5MEsd-mq-fby8HKoriqi90A5DBLRiftQzwD9Wb3KPHej3pQ0-z5LHoJknwJhw88qXBKHE2z3I4JGd-&google_hm=Az-oSy9gIUJDq9wR-50KZsc

170 B
188 B

36ms
36ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJypGwO_M2LXek0xa5MEsd-mq-fby8HKoriqi90A5DBLRiftQzwD9Wb3KPHej3pQ0-z5LHoJknwJhw88qXBKHE2z3I4JGd-&google_hm=Az-oSy9gIUJDq9wR-50KZsc

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJypGwO_M2LXek0xa5MEsd-mq-fby8HKoriqi90A5DBLRiftQzwD9Wb3KPHej3pQ0-z5LHoJknwJhw88qXBKHE2z3I4JGd-&google_hm=Az-oSy9gIUJDq9wR-50KZsc
date: Thu, 16 Sep 2021 08:45:22 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX3fa84b2f60214243abdc11fb9d0a66c7003
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 644D
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEBi0DlLohF1bFKCRJ7HtbnQ&google_cver=1&google_push=AYg5qPLXXBElsT65QZi0ul6oWYqTpj8e4Rr4PJMIt208DMjnpzfwNfyLgIZLIEnlOLmvAeQm1q...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEBi0DlLohF1bFKCRJ7HtbnQ&google_cver=1&google_push=AYg5qPLXXBElsT65QZi0ul6oWYqTpj8e4Rr4PJMIt208DMjnpzfwNfyLgIZLIEnlOLmvAeQm1q...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Ld3lMUHZGRTJ1RkQybDVMMkpRc2JPaVNnNzlYR28xZH5B&google_push=AYg5qPLXXBElsT65QZi0ul6oWYqTpj8e4Rr4PJMIt208DMjnpzfwNfyLg...

170 B
188 B

38ms
37ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Ld3lMUHZGRTJ1RkQybDVMMkpRc2JPaVNnNzlYR28xZH5B&google_push=AYg5qPLXXBElsT65QZi0ul6oWYqTpj8e4Rr4PJMIt208DMjnpzfwNfyLgIZLIEnlOLmvAeQm1qsUYcc7X8jdV2vzVukwcuxK0PkR

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Ld3lMUHZGRTJ1RkQybDVMMkpRc2JPaVNnNzlYR28xZH5B&google_push=AYg5qPLXXBElsT65QZi0ul6oWYqTpj8e4Rr4PJMIt208DMjnpzfwNfyLgIZLIEnlOLmvAeQm1qsUYcc7X8jdV2vzVukwcuxK0PkR
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 644D 0
12 B 34ms
34ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JwhNo_WuRxAzFkkoUeaa8QqFhBBOfVog7yiqcVl2ZU2dNuczI5_2YG1C5djuRXkH3GIPoClQ

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 31ms
31ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021091503&jk=41208518953562&bg=!-vml-b3NAAaUnz4elJ87ACkAdvg8WquIdXDcRmm3wA9FglD-5l1NVeaVKySqXlG_RbvmguPjQbvfBwIAAAC9UgAAAB5oAQeZAoAP5X1dneWh5ja2VrYCRSRS7fhhCEE7kxFE-_JEEMYZMbN_HsLUEZ4SunxOvvvyoQv7swJb-1uuWN2AmBCOpkH-EJEBhqo9TWUNO5QOQBcoK3-bPS0Ywvx2iGQnY3sgUuWYDTsDnaLf1c9BayA8BQgyJwi_ottAzPWYGmIjB8Vxg7TIVxYzYrtiQg9-HlaxpRcQlEdfaOAHAhAah--pIJhOIp21v6wI7LPwAq9npXVEHMsKLxn-5PRHbR-oPZKWqK9N8pAnJkFoEc8lsZnZunXiDGqTSXcqxhnOf7tyAvPNvEDMj2X-3n939p4qv0tW9rgCrNvl1xdi2CsO2qYUvAzUiLKLKfkjzTABUfhfv7WpTvNG5NcS5XpJVFI4VKTOhrzfMdvp9jdDOET61Yf48rP5CyB1iX5YY4tlm-cRfeL6mY1U02wPWB44Ft7mxMikccmbqb6mW8ivnbvS4IdfaKlsFrN2wJh-AoXyIpdIiyBOD_Kp-6DaowV4CM1AYE-vgfNzhFZkE_fJZf3p8ZH8IXzVOhCiI6vu-UXrgHEk6Tj0pqoNd5EiwSKeIL4vWMiPtAKJhpePAHYlDMCHQ4rO_L0TY38NKOhm-HnD1LF_3T5aAKZLcK7AVEqlvuX0j1l9WPc7D9Yn6IUHXmgnSuJskONELishu8AvebVnD85SZFtCutIciAMipZrvvBZNMCjvKzwQVra-FJ-F3jcL7cVgKQkeDjkjqEgSAlLdaS09b29_s5Gzn6ah9n3-3K9grCFwZSbRGdgzn2SppcXqWR5fAZvTyOQzQWQrNx8qUcnDuWxTS9SpwxwV4qvd1fybZmooRonrKYhI2twgDfv1099G96f4

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FB7D 0
20 B 30ms
29ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BD3hpIQRDYZ-yJ5KMlQfN9IKgDwAAAAA4AeAEAg&bg=!b2ylbCjNAAaUnz4elJ87ACkAdvg8WlJ4XUwj33EmR-4GPLXMtrbTFJqvG_Eu_cK0mK_5uSJrVUwxzgIAAAEFUgAAABBoAQeZAspXNOVVfcl7Drbow66utKU3HVSNyJpgA9XHMIzxpwR5gCRuXYXHHgpIZ0AZmaHVo3ndaMpnVjcl6HCITLJf2ls5b6Aa9deOgecqR9I-hEnMRtO4qjF_zfqJK0xup4t_SjKtzpePbVKD_VJkYD8K-6GZTdT2J4vpS1FUnvXGW5-e9x7TYXwHxMiN3VPryf_Lu4K96Fjz3nPwDAz6t_6k-bfEXRocwFmL9euyAZj4GxeEYGxe4NIgqjS7ws3I53wG1IqQLSuA7yauIhbe2A0eMpSyOpRa_MGku1VC1F6Gd4xem0X0b4fYD1vz13S8M43PKZMzOCcNneS7tKwrjDqQc-BQnKJ4r7Z0Z3-QrybxuIFdnK9EMOgDznEZeXueQUQdvjdOb3TZ99io6gyzE7HcxzBh2YZomODofcrg7PAQ3cQAZAThMiZ81QkKe34SjnqRB_WW1UxPFxqe2iN-CKEbJfUh7m-FxQvOHpFh5QRXJ0YcUqiPy5DexU34qIAZgEH_zjFpWSNzio2ERE-yOL6vxEKAxydzVOetpzbNEkt7BVlxcLPP_w-nFim1gUrdgmRq4JwbPD7tNBC1SDKKBLdNAvjvSnjdBNGVse7Y7Q7l1yOxV1FOE4ambzd3w9A-nNU9767nv8zhz0xMDG6JJ2rEzHFsZ3heNFw0Qai96vpWQVvxmIC-9b6EV7djlrEEQlFQgafx_BWYNolpL_xlwnndiIsOeRX3UOf23oCK5B694SrQLnK_IypSUe-Evikl5maFz72gMWVgRvXEuPrY-I7DC5HW6tlO__l46prMrhtzNpEWuCkP8dc6BNk1Fk5JSq37JErOF_Ns4QTSpckq7PZ5OHwofzwbSwoMWk0E-vtfr0JAmdBhLFDyPQHiaETTR_bQRCLGn-IstKgtZCT5MPTmw7wztw3wGEYVVYipBPD-eEQk-XMypHnob38xbJc

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame B950 77 B
162 B 26ms
26ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Thu, 16 Sep 2021 08:45:22 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 28ms
28ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Sep 2021 08:45:21 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H/1.1 200
OK viewability Show response
hal900026.redintelligence.net/ Frame 9C02 0
150 B 34ms
12ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900026.redintelligence.net/viewability?s=98785200072947400710580011719026&a=463f5590&vb=m
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=98785200072947400710580011719026&a=bd47fe28
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/request_content.php?s=98785200072947400710580011719026&a=bd47fe28
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 dc_pre=CJ-Ryq6Ng_MCFQevUQod860PDA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4731447349104.531
adservice.google.com/ddm/fls/z/ Frame A0F8 42 B
63 B 79ms
32ms Image
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJ-Ryq6Ng_MCFQevUQod860PDA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4731447349104.531

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJ-Ryq6Ng_MCFQevUQod860PDA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4731447349104.531?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame B950 77 B
162 B 28ms
28ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Thu, 16 Sep 2021 08:45:21 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 26ms
26ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Sep 2021 08:45:21 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 0DC8
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=52448400055849800710580011719014&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=52448400055849800710580011719014&actionid=731824&produktid=businessgiro&dt_url=

0
90 B

20ms
20ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=52448400055849800710580011719014&actionid=731824&produktid=businessgiro&dt_url=

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=a1d1a91aac&subid=&uid=5cfb712e182fd8a1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCIhbpIARDYaGyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9DCtnk0rm_qPMwYkoioTmXoXAP8IH5QYuiWGkPoZXL1s1Nw6Fb58GSoTVSg2LFD-BwJK5bGzdE--Y3cZbAF2HGIHCDG42kTctDxuKFmF_CZE1VIOYmE6K4rv6mDg_RC8jhEHPDphgaIFZksPextt3Q_G-dwXyQSctetwEcRNkyHg8lrmSXSk5Np2z7g2G6x5-tQWfce7Lnt3SvEW1aIYdc_zwDXSOgzgcAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRo1Zyy0XB5_UdE33Cd9sk91g%26sig%3DAOD64_2L-2Q-QE0_CBxw0FSn-DBrkLF8yw%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-Dr-l-hhMcN8YUzTItW1pDTRjnOuHQRp2zAn_xzcRD6DmwiFG0-sxbuCOj95ACVZwLTi64P0aDSLQmy_u2baU58ce_3BfPf-1Q04vLkAVtBmOK7XEVx2N7vZgehO1uuzt4xCmFN6bMhr0YHye085BALdgnPYw%26cry%3D1%26dbm_d%3DAKAmf-Asimj05By_i6nHxD519z_p4uJUJVmisWyParhEXYR_gSk5VeEmbQa1L26R-8-4N7-2y3aJgdgrjIdKFXGZ4XitnIp5o2y7FZKocwHWQqsGDJqNKFGr7lkSbc0ulj-9Udw6MzxUUZ_ETek1zgeNInuE3Oh_1YGqPtBhBE0DzuAH_1pqUxQb8bg89BxG6y-SwHa3vy8w0A5WFsD5KRbKOIsp-Fp9jMPey8CP4npy-m1qCNMK7PrPMWGvn73tn746KYT9aofErGh8cLRmc7bT6r2zGmqqsC2HLQiVfDZtEok3Pk8vdgCgH7EZyThhHbEgpo82ugMx7-pzk8nTpT1m1FDyfISqBX-nVrIVQUec9K007IrCVSllROfSyUt5nP5_HRyZVM4BymiyT_wy58jtGMtVtetPxkEOJ9rmoJvcZZ1zkCV5bIp9GSNR8n-NFk_BMsfM3CMv%26adurl%3D&documentReferer=https%3A%2F%2F3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2F3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fblip.fm&random=2072622204492&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: pb.media01.eu
:scheme: https
:path: /view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=52448400055849800710580011719014&actionid=731824&produktid=businessgiro&dt_url=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: DTU=72502E6A4ADED13235A8EEEC5F5AAF2E
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 16 Sep 2021 10:45:22 GMT
server: Microsoft-IIS/10.0
set-cookie: ASP.NET_SessionId=s5ura2jz4va3jwnbq1hf45sb; path=/; secure; HttpOnly DTU=72502E6A4ADED13235A8EEEC5F5AAF2E; expires=Sat, 16-Sep-2023 08:45:22 GMT; path=/; SameSite=None; secure; HttpOnly
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
access-control-allow-origin: *
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Thu, 16 Sep 2021 08:45:21 GMT
content-length: 0

Redirect headers

Server: nginx/1.17.5
Date: Thu, 16 Sep 2021 08:45:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Keep-Alive: timeout=20
X-Powered-By: PHP/7.2.21
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Range, Content-Disposition, Content-Type, Authorization
Access-Control-Allow-Credentials: true
Set-Cookie: trscj=MTYzMTc4MTkyMnxMM1J5WTJzdlpYQjJMMlU1T1dGaFkyVTVOR1UyWlRVNE56TTRNekJoTjJSbU9HUmxaR0UwWVdFMlAzTjFZbWxrUFRVeU5EUTROREF3TURVMU9EUTVPREF3TnpFd05UZ3dNREV4TnpFNU1ERTBKblE5YUhSc2NBPT18YUhSMGNITTZMeTh6WldNMVl6Z3pZelUxTWpNM01ETmxaVEF4WXpSbFpUTTNNRGMwTldaak5DNXpZV1psWm5KaGJXVXVaMjl2WjJ4bGMzbHVaR2xqWVhScGIyNHVZMjl0THc9PQ%3D%3D; expires=Fri, 16-Sep-2022 08:45:22 GMT; Max-Age=31536000; path=/; samesite=none; domain=.medialead.de; secure SERVERID177589=1|YUMEJ|YUMEJ; path=/; HttpOnly
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=52448400055849800710580011719014&actionid=731824&produktid=businessgiro&dt_url=
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload max-age=15768000
X-IPLB-Request-ID: D8836FA8:DD14_91EFC182:01BB_61430422_7A4578D:2667E
X-IPLB-Instance: 40028
Cache-control: private

GET
H3

200

activityi;dc_pre=CN206a6Ng_MCFaiPUQodLN0NIg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6134541215140.419 Show response
5994599.fls.doubleclick.net/ Frame 8360
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6134541215140.419?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CN206a6Ng_MCFaiPUQodLN0NIg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6134541215140.419?

391 B
343 B

40ms
39ms

Document
text/html

142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CN206a6Ng_MCFaiPUQodLN0NIg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6134541215140.419?

Requested by

Host: blip.fm
URL: https://blip.fm/cheekcomma49

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

6e5685e9e66c8956897dd8f077334d4d45603f02c9401a8d5597f049d3d58a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CN206a6Ng_MCFaiPUQodLN0NIg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6134541215140.419?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlKbJvoO9z3SSPSQ9l4Y4rI2QmdMUwXz5ZiI2gm4G9dCZ7_3ymzaSf5__xM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 16 Sep 2021 08:45:22 GMT
expires: Thu, 16 Sep 2021 08:45:22 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 320
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 16 Sep 2021 08:45:22 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CN206a6Ng_MCFaiPUQodLN0NIg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6134541215140.419?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900014.redintelligence.net/ Frame 2D2E 7 KB
2 KB 34ms
12ms Document
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request_content.php?s=52448400055849800710580011719014&a=2fc38562
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=a1d1a91aac&subid=&uid=5cfb712e182fd8a1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCIhbpIARDYaGyMs283gOvkozQBo_g-IZT_bGLpMoM8C4QASC1y4pGYJXikIKgB8gBCakCDBNEveTTsz6oAwGqBKkBT9DCtnk0rm_qPMwYkoioTmXoXAP8IH5QYuiWGkPoZXL1s1Nw6Fb58GSoTVSg2LFD-BwJK5bGzdE--Y3cZbAF2HGIHCDG42kTctDxuKFmF_CZE1VIOYmE6K4rv6mDg_RC8jhEHPDphgaIFZksPextt3Q_G-dwXyQSctetwEcRNkyHg8lrmSXSk5Np2z7g2G6x5-tQWfce7Lnt3SvEW1aIYdc_zwDXSOgzgcAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTgxMDUxOTU4MDM5MTQwNjmACgOYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRo1Zyy0XB5_UdE33Cd9sk91g%26sig%3DAOD64_2L-2Q-QE0_CBxw0FSn-DBrkLF8yw%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-Dr-l-hhMcN8YUzTItW1pDTRjnOuHQRp2zAn_xzcRD6DmwiFG0-sxbuCOj95ACVZwLTi64P0aDSLQmy_u2baU58ce_3BfPf-1Q04vLkAVtBmOK7XEVx2N7vZgehO1uuzt4xCmFN6bMhr0YHye085BALdgnPYw%26cry%3D1%26dbm_d%3DAKAmf-Asimj05By_i6nHxD519z_p4uJUJVmisWyParhEXYR_gSk5VeEmbQa1L26R-8-4N7-2y3aJgdgrjIdKFXGZ4XitnIp5o2y7FZKocwHWQqsGDJqNKFGr7lkSbc0ulj-9Udw6MzxUUZ_ETek1zgeNInuE3Oh_1YGqPtBhBE0DzuAH_1pqUxQb8bg89BxG6y-SwHa3vy8w0A5WFsD5KRbKOIsp-Fp9jMPey8CP4npy-m1qCNMK7PrPMWGvn73tn746KYT9aofErGh8cLRmc7bT6r2zGmqqsC2HLQiVfDZtEok3Pk8vdgCgH7EZyThhHbEgpo82ugMx7-pzk8nTpT1m1FDyfISqBX-nVrIVQUec9K007IrCVSllROfSyUt5nP5_HRyZVM4BymiyT_wy58jtGMtVtetPxkEOJ9rmoJvcZZ1zkCV5bIp9GSNR8n-NFk_BMsfM3CMv%26adurl%3D&documentReferer=https%3A%2F%2F3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2F3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fblip.fm&random=2072622204492&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: d74d01ffe54df69480d76f973b42be6e96a245ce7bca8660c44aed6d09be931c

Request headers

Host: hal900014.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=5423a7650f19d014
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 16 Sep 2021 09:45:22 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2056
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 572E
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=52448400055849800710580011719014
https://ad-server.eu/wm/pb/native.png

68 B
312 B

30ms
29ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:48:42 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: nginx/1.17.5
X-IPLB-Request-ID: D8836FA8:DD26_91EFC182:01BB_61430422_7A20D0D:396B
X-Powered-By: PHP/7.2.21
X-IPLB-Instance: 40027
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload, max-age=15768000
Content-Type: text/html; charset=UTF-8
Location: https://ad-server.eu/wm/pb/native.png
Cache-control: private
Transfer-Encoding: chunked
Keep-Alive: timeout=20

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 572E 43 B
704 B 32ms
31ms Image
image/gif 104.92.94.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2601049&v=18332&q=376776&r=296283&pref1=52448400055849800710580011719014&pv=1

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.94.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:22 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 572E 43 B
704 B 34ms
33ms Image
image/gif 104.92.94.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2338577&v=11830&q=357066&r=296283&pref1=52448400055849800710580011719014&pv=1

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.94.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 16 Sep 2021 08:45:22 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9475 1 KB
749 B 20ms
20ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 15 Sep 2021 08:58:57 GMT
expires: Thu, 16 Sep 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
cache-control: public, max-age=86400
age: 85585
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9475
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECtfhU4Hw04SWwhSxxi_vaI&google_push=AYg5qPLBtR0DMXZqb2Xyngq7R-GKB7zx4oKwWt0pfl8Dj82buXGQdkup-P...

170 B
188 B

37ms
37ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECtfhU4Hw04SWwhSxxi_vaI&google_push=AYg5qPLBtR0DMXZqb2Xyngq7R-GKB7zx4oKwWt0pfl8Dj82buXGQdkup-Pr5-bZCZ0QidYvcDBEe3qD1d7rmfYZwnBA4ugQ7vmSl

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1631781923.758562,VS0,VE93
x-served-by: cache-hhn4038-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECtfhU4Hw04SWwhSxxi_vaI&google_push=AYg5qPLBtR0DMXZqb2Xyngq7R-GKB7zx4oKwWt0pfl8Dj82buXGQdkup-Pr5-bZCZ0QidYvcDBEe3qD1d7rmfYZwnBA4ugQ7vmSl
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9475
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEK6xjLhGsrAa5d1XtQHBNb0&google_cver=1&google_push=AYg5qPLITQpTyOqmJcz63GfiWLzJwgM3O5dRp8JgHA2Z6qU9hhYOafu7osrZlEIYf9s5F7iPoBySfrS2C0-6VSRT...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=q6AdiOg8TTOEIu1AUIBmcA2&google_push=AYg5qPLITQpTyOqmJcz63GfiWLzJwgM3O5dRp8JgHA2Z6qU9hhYOafu7osrZlEIYf9s5F7iPoBySfrS2C0-6VSRTtE6zZRyViNDO

170 B
188 B

39ms
39ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=q6AdiOg8TTOEIu1AUIBmcA2&google_push=AYg5qPLITQpTyOqmJcz63GfiWLzJwgM3O5dRp8JgHA2Z6qU9hhYOafu7osrZlEIYf9s5F7iPoBySfrS2C0-6VSRTtE6zZRyViNDO

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 16 Sep 2021 08:45:22 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=q6AdiOg8TTOEIu1AUIBmcA2&google_push=AYg5qPLITQpTyOqmJcz63GfiWLzJwgM3O5dRp8JgHA2Z6qU9hhYOafu7osrZlEIYf9s5F7iPoBySfrS2C0-6VSRTtE6zZRyViNDO
x-host: tde-deliveryengine-production-7f8fcb5db4-fz9pv
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9475
Redirect Chain

https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOHBwhtpJfB4pZJp57L7xQk&google_cver=1&google_push=AYg5qPKd7zebYJOMdJxVDp-lN_4FHxfugMZfP74lWcVsbo1nZ3fkYd-gtvYoz...
https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOHBwhtpJfB4pZJp57L7xQk&google_cver=1&google_push=AYg5qPKd7zebYJOMdJxVDp-lN_4FHxfugMZfP74lWcVsbo1nZ3fkYd-gtvYoz...
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=xSaJIraIGVX6oY7_EKAdLg&google_push=AYg5qPKd7zebYJOMdJxVDp-lN_4FHxfugMZfP74lWcVsbo1nZ3fkYd-gtvYozwWBnEjUyzzp9TjqjjKOI...

170 B
188 B

37ms
37ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=xSaJIraIGVX6oY7_EKAdLg&google_push=AYg5qPKd7zebYJOMdJxVDp-lN_4FHxfugMZfP74lWcVsbo1nZ3fkYd-gtvYozwWBnEjUyzzp9TjqjjKOIJLWp6rJRJ5w5K-MJ2Ik

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: nginx
Vary: Accept
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=xSaJIraIGVX6oY7_EKAdLg&google_push=AYg5qPKd7zebYJOMdJxVDp-lN_4FHxfugMZfP74lWcVsbo1nZ3fkYd-gtvYozwWBnEjUyzzp9TjqjjKOIJLWp6rJRJ5w5K-MJ2Ik
Connection: close
Content-Type: text/plain; charset=utf-8
Content-Length: 238

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9475
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEEeLl2TJat0hQTu6MYO_zjU&google_cver=1&google_push=AYg5qPISsg3Xv5iSCXX1KxEuJcxSxhIrcbQcgCLWpUF6RiQYK135xxezT5D1rzCoiwEsVckX4aUUBAv1...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzE3NDE0NjgyNjA4MzA1NjMxNA&google_push=AYg5qPISsg3Xv5iSCXX1KxEuJcxSxhIrcbQcgCLWpUF6RiQYK135xxezT5D1rzCoiwEsVckX4aUUBA...

170 B
188 B

39ms
39ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzE3NDE0NjgyNjA4MzA1NjMxNA&google_push=AYg5qPISsg3Xv5iSCXX1KxEuJcxSxhIrcbQcgCLWpUF6RiQYK135xxezT5D1rzCoiwEsVckX4aUUBAv1tUkScnuXlrgCl54Ktgp_

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzE3NDE0NjgyNjA4MzA1NjMxNA&google_push=AYg5qPISsg3Xv5iSCXX1KxEuJcxSxhIrcbQcgCLWpUF6RiQYK135xxezT5D1rzCoiwEsVckX4aUUBAv1tUkScnuXlrgCl54Ktgp_
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9475
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBnJaNisVdHafqQ1unYADWg&google_cver=1&google_push=AYg5qPIisFkYt4Q0JWTgDugsfKOEWCzsPYavv1ffHEbE-cSy6XQaRfbiKezmbOqT5UiBhfJ_ScZ...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RNT1RQUjUtMjYtNjlLRA==&google_push=AYg5qPIisFkYt4Q0JWTgDugsfKOEWCzsPYavv1ffHEbE-cSy6XQaRfbiKezmbOqT5UiBhfJ_ScZoGqMPfUU6XBGlemsZf1S3_Nk

170 B
188 B

37ms
37ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RNT1RQUjUtMjYtNjlLRA==&google_push=AYg5qPIisFkYt4Q0JWTgDugsfKOEWCzsPYavv1ffHEbE-cSy6XQaRfbiKezmbOqT5UiBhfJ_ScZoGqMPfUU6XBGlemsZf1S3_Nk

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1RNT1RQUjUtMjYtNjlLRA==&google_push=AYg5qPIisFkYt4Q0JWTgDugsfKOEWCzsPYavv1ffHEbE-cSy6XQaRfbiKezmbOqT5UiBhfJ_ScZoGqMPfUU6XBGlemsZf1S3_Nk
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 9475
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEORMAbuTHmu_9iNUijfPUdE&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUMEIZLI7xinGwcoitvTWQAABHUAAAIB&google_cver=1&google_push=AYg5qPIkE1OsTVC1G-JMeLCAT30KeClnODhxhHis1qB7MaKKYzLGsniNJpyMRNrqT6YLzDDlhJPJ...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9475
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEBi0DlLohF1bFKCRJ7HtbnQ&google_cver=1&google_push=AYg5qPKwkcgH_hOVTsdB4QF3cC3Td-w-ryrd0THqaf7y4X57e8-F_lUQHpLsy_B-9txSnzuv3X...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Ld3lMUHZGRTJ1RkQybDVMMkpRc2JPaVNnNzlYR28xZH5B&google_push=AYg5qPKwkcgH_hOVTsdB4QF3cC3Td-w-ryrd0THqaf7y4X57e8-F_lUQH...

170 B
188 B

39ms
39ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Ld3lMUHZGRTJ1RkQybDVMMkpRc2JPaVNnNzlYR28xZH5B&google_push=AYg5qPKwkcgH_hOVTsdB4QF3cC3Td-w-ryrd0THqaf7y4X57e8-F_lUQHpLsy_B-9txSnzuv3XBifZaYo3ASVJhPQvXvE7Rp53bBkA

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Ld3lMUHZGRTJ1RkQybDVMMkpRc2JPaVNnNzlYR28xZH5B&google_push=AYg5qPKwkcgH_hOVTsdB4QF3cC3Td-w-ryrd0THqaf7y4X57e8-F_lUQHpLsy_B-9txSnzuv3XBifZaYo3ASVJhPQvXvE7Rp53bBkA
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9475 0
12 B 36ms
35ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IGmDamUvkfIeZwO4vIaq976PT0LBSYkU54xcbO8HkOFT3n5zTTSQOixZPJ1kCNJZDxLJMDuA

Requested by

Host: 3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com
URL: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f10.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 08:45:22 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 css
fonts.googleapis.com/ Frame 2D2E 1 KB
418 B 32ms
31ms Stylesheet
text/css 142.250.184.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=52448400055849800710580011719014&a=2fc38562

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9c1521286e7dd2d6f8c2262b15bca8867bcae973a83879accdd00e1cb9831e5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 08:28:31 GMT
server: ESF
date: Thu, 16 Sep 2021 08:45:22 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 16 Sep 2021 08:45:22 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2D2E 15 KB
15 KB 35ms
12ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/laptop_1200x627.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=52448400055849800710580011719014&a=2fc38562
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 5056177acbc38cca19e94f647e8cd7370346e19735b1453910928867b4625b38

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15250
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2D2E 15 KB
15 KB 34ms
13ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52343/creativesup/1200x627_2.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=52448400055849800710580011719014&a=2fc38562
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 6153a3fab9985cf016adadf717935658544342f3dba2bc85855dac6158b0d6ea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15250
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2D2E 14 KB
14 KB 35ms
12ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/32783/creativesup/native_ad_globus_baumarkt_1200x627.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=52448400055849800710580011719014&a=2fc38562
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 4b8524dcf65dbdd20638c7da046e47d59368d6f926f6a39b8891923cc55b8f95

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 14131
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900014.redintelligence.net/ Frame 2D2E 0
150 B 34ms
12ms Script
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/viewability?s=52448400055849800710580011719014&a=91615558&vb=m
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=52448400055849800710580011719014&a=2fc38562
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/request_content.php?s=52448400055849800710580011719014&a=2fc38562
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:22 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 dc_pre=CN206a6Ng_MCFaiPUQodLN0NIg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6134541215140.419
adservice.google.com/ddm/fls/z/ Frame 8360 42 B
63 B 31ms
31ms Image
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CN206a6Ng_MCFaiPUQodLN0NIg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6134541215140.419

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CN206a6Ng_MCFaiPUQodLN0NIg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=6134541215140.419?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame B950 77 B
162 B 29ms
29ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Thu, 16 Sep 2021 08:45:22 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 26ms
26ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Sep 2021 08:45:22 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H/1.1 200
OK viewability Show response
hal900026.redintelligence.net/ Frame 9C02 0
150 B 38ms
15ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900026.redintelligence.net/viewability?s=98785200072947400710580011719026&a=463f5590&vb=v
Requested by: Host: hal900026.redintelligence.net
URL: https://hal900026.redintelligence.net/request_content.php?s=98785200072947400710580011719026&a=bd47fe28
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900026.redintelligence.net/request_content.php?s=98785200072947400710580011719026&a=bd47fe28
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:23 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK viewability Show response
hal900014.redintelligence.net/ Frame 2D2E 0
150 B 33ms
11ms Script
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/viewability?s=52448400055849800710580011719014&a=91615558&vb=v
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=52448400055849800710580011719014&a=2fc38562
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/request_content.php?s=52448400055849800710580011719014&a=2fc38562
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 16 Sep 2021 08:45:23 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame B950 77 B
162 B 26ms
26ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Thu, 16 Sep 2021 08:45:24 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 26ms
26ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Sep 2021 08:45:24 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
DATA 200
OK truncated
/ Frame 572E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 016428651293c2cd5801a8b8e1a7463757be03a3fe60c2d000576736cbc16603

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9713 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 13f30fc167225cab3878115391ef459e8893a81afd7ff2c043ac5d2a183f0f3a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame B950 77 B
162 B 28ms
28ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Thu, 16 Sep 2021 08:45:24 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 27ms
27ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Sep 2021 08:45:24 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame B950 77 B
162 B 28ms
28ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Thu, 16 Sep 2021 08:45:25 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 28ms
27ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Thu, 16 Sep 2021 08:45:25 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 572E 42 B
64 B 67ms
36ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsto-rhSaSEXQTqvhiFkrit13y4DaJFmUfFi8MujytDT7bjcaYNGN2XAhGqyDChjE5axHGpQRArztO0FZnyKFMHMebb7KJ-_6eYwrPfn&sai=AMfl-YQR0rL6b3mKhbQ6rIu9iQ6U2PqD2Ftl3VnmGnxAJzbPn6y3FHZEgp9sQr0RAQ1T4DWj5Uz3IBY4m9kBDaK7rf0f8QGLKneHhwxrHJMlDibKYoWJ8LAyJOnOZzP7&sig=Cg0ArKJSzOPFDBhgIyNpEAE&cid=CAASEuRo1Zyy0XB5_UdE33Cd9sk91g&id=lidar2&mcvt=1001&p=689,315,779,1043&asp=689,315,779,1043&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20210915&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3076314635&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&eosm=0&rst=1631781921614&rpt=3041&isd=0&lsd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://3ec5c83c5523703ee01c4ee370745fc4.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Sep 2021 08:45:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9713 42 B
64 B 40ms
37ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuF0abA0j0KcqA45rsgU60GjIER_jsOMWSNtVfadEMVvH1_iYqRaf6uzYORQX8rwEWdlz8LyTFXoQZABb7dNaLzlIM9Z6j49caRtYra&sai=AMfl-YSVGwYrQBSSqGthHP_MgvGgyO8vzEdNFZ3r5MqFvhgamGUYUVR8JCtsTuGcH4rlOZP9yUk4JWIPL-bOBvNIeLcOqTfVfEyx7kUYuNQdC4pZBei_tTFK8Gq33RNK&sig=Cg0ArKJSzNPZIW9nVVx_EAE&cid=CAASEuRoFJ1VVmzvu5lk7LvMNtD6LQ&id=lidar2&mcvt=1001&p=1110,436,1200,1164&asp=1110,436,1200,1164&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20210915&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3224969948&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&eosm=0&rst=1631781921562&rpt=3122&isd=0&lsd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS