simcast.com Open in urlscan Pro
45.79.244.12 Public Scan

ec2-54-158-226-104.compute-1.amazonaws.com

Software

Resource Hash

480613f771d4b2960ecbcbf9f0a8435d009d8f5fd10ab14bba1b1018762708e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Sat, 26 Nov 2022 10:08:46 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 204 any Show response
idx.liadm.com/idex/prebid/ 0
309 B 350ms
115ms XHR
text/plain 54.158.226.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/prebid/any?resolve=nonId

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.158.226.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-credentials: true
trace-id: d3de921af695c973
vary: Origin
request-time: 1

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
313 B 155ms
50ms XHR
application/json 52.19.187.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.187.82 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-187-82.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:47 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.6.166
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
398 B 80ms
25ms XHR
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

b82156a924667c27e8e9ddb51cdc88678f9a7adca51d09a6b8c6962852571c4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Sat, 26 Nov 2022 10:08:46 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 publishertag.prebid.130.js Show response
static.criteo.net/js/ld/ 88 KB
29 KB 173ms
83ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.130.js

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a26695adab8d7538059dd2a25948c481f5a8fffefee171985a305f9fea9dd628

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:47 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Sat, 17 Sep 2022 19:59:55 GMT
server: nginx
etag: W/"6326273b-16120"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 27 Nov 2022 10:08:47 GMT

POST
H/1.1 200 579.json Show response
id5-sync.com/g/v2/ 216 B
621 B 66ms
23ms XHR
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/579.json

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

3f48a02f94d8bbb0da33a70f1dcfde11f6e62b257b6389a556350a8f8cf8aa0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Sat, 26 Nov 2022 10:08:46 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 9ECA 15 KB
6 KB 130ms
43ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=simcast.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

d0f07190791630edc058ad6e5a33a3cda6a8f85c470e593ce0bbed46ffec148b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:47 GMT
server: Kestrel
server-processing-duration-in-ticks: 1004812
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 153ms
76ms XHR
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

61c1317e433c125a2ebbbdaf22fc3a0b3606bcb0c9cfea151425adf7b5195f48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-16294"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 27 Nov 2022 10:08:48 GMT

GET
H2 200 pubcid.min.js Show response
id.sharedid.org/lib/ 732 B
904 B 592ms
192ms Script
application/javascript 35.167.189.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.sharedid.org/lib/pubcid.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.167.189.6 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-167-189-6.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
cache-control: public, max-age=86400
last-modified: Tue, 22 Nov 2022 19:18:19 GMT
accept-ranges: bytes
content-length: 732
vary: accept-encoding
content-type: application/javascript

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 58 KB
17 KB 105ms
48ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a97afd769b3d774563606be9e943789398af5a1bf3583c2bc9a81f99832aa2b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 24 Nov 2022 12:48:29 GMT
server: cloudflare
x-amz-request-id: BBBA0A3QDQ1HWH2T
age: 2443
etag: W/"91dadf6b1eddd8d91a5cc2e3be5ea8cf"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7701d32cce558fee-FRA
x-amz-id-2: ifirG6OKyiUb0CDm3Pp6NFXSRsipT+RfZA795jySpk4Hznc40wDcE3MyvtCBhb4h+QHIekyQ8Ho=

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 39 KB
13 KB 44ms
43ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f066a6392f3732829e95d97ac2a3dfb7dc7d35fc88d71a4ef62ff8f70399326c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-9c1f"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 27 Nov 2022 10:08:48 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 32 KB
10 KB 78ms
22ms Script
text/javascript 18.66.97.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-88.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 66a8dfcc4572e000bf5b4351bae2a763b3357a65ed373ff27a7e7b38ec9486ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 19:00:23 GMT
content-encoding: gzip
via: 1.1 0c688bb347bc402edc1209f13e04d88c.cloudfront.net (CloudFront)
last-modified: Mon, 21 Nov 2022 18:55:41 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 54506
x-amz-server-side-encryption: AES256
etag: W/"2c5f4a319c3d99310927955777b5abe3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-id: KrMEow17xWPDYY1R9cRmMJQ9-QFo483ayzews0I1jx0b0XH0Wi8OGQ==

GET
H2 200 uid2-sdk-0.0.1b.js Show response
prod.uidapi.com/static/js/ 3 KB
3 KB 357ms
118ms Script
application/javascript 18.117.26.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.uidapi.com/static/js/uid2-sdk-0.0.1b.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.117.26.60 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-117-26-60.us-east-2.compute.amazonaws.com
Software: /
Resource Hash: 76424452f8e1eb0bc7fb20f6d7fa0dcaea480d7152a74756c01e816a663c3aa1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
cache-control: public, max-age=86400
last-modified: Mon, 31 Oct 2022 06:06:26 GMT
accept-ranges: bytes
content-length: 3211
vary: accept-encoding
content-type: application/javascript

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/032211111611000/ Frame 7CCF 221 KB
61 KB 102ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032211111611000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f55c14576b73b1fa761c9722153509875403c18b3a6916045fd146f3e3a6a00

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 23 Nov 2022 00:19:59 GMT
age: 294529
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61627
x-xss-protection: 0
server: sffe
etag: "0be482f0352f4793"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 23 Nov 2023 00:19:59 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/032211111611000/v0/ Frame 7CCF 14 KB
5 KB 137ms
58ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032211111611000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4529063318c99582948589c202835d859092d2a24e417f4f0a3ccfe8211ad37e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 23 Nov 2022 00:19:59 GMT
age: 294529
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5201
x-xss-protection: 0
server: sffe
etag: "0e2d67a193799b94"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 23 Nov 2023 00:19:59 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/032211111611000/v0/ Frame 7CCF 94 KB
28 KB 140ms
61ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032211111611000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7b74f18b90d3a161b71d0fef3b4de6db5cdb3732dfaa445740bfd2042f78b9f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 21 Nov 2022 23:12:16 GMT
age: 384992
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28866
x-xss-protection: 0
server: sffe
etag: "61003bcde0ed5887"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 21 Nov 2023 23:12:16 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/032211111611000/v0/ Frame 7CCF 5 KB
2 KB 151ms
72ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032211111611000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b3b63fa8f90f3f8b30a8c57665c86ad065073211f0f55a51d3b6f8cee295e3aa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 23 Nov 2022 00:19:59 GMT
age: 294529
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1906
x-xss-protection: 0
server: sffe
etag: "d44263764bdab45e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 23 Nov 2023 00:19:59 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/032211111611000/v0/ Frame 7CCF 40 KB
13 KB 149ms
70ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032211111611000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99c69003f1b475f64a578b13fdfd566cc32c9ec0d7e51aabfe5c2b58de70918f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 23 Nov 2022 00:19:59 GMT
age: 294529
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12947
x-xss-protection: 0
server: sffe
etag: "9cd92599851d18a1"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 23 Nov 2023 00:19:59 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 7CCF 8 KB
895 B 76ms
31ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 26 Nov 2022 08:58:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 26 Nov 2022 10:08:48 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7CCF 2 KB
2 KB 24ms
24ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=timotolkki.net&pcid=802&rid=152&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 09:39:53 GMT
x-content-type-options: nosniff
server: cafe
age: 1735
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sun, 27 Nov 2022 09:39:53 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7CCF 295 B
319 B 23ms
22ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=timotolkki.net&pcid=802&rid=152&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 11:55:19 GMT
x-content-type-options: nosniff
server: cafe
age: 80009
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Sat, 26 Nov 2022 11:55:19 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7CCF 0
0 79ms
30ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQDhxqCAsrn59SFPwiJwQWfejYuxNxBuE6vZtq3X6Zrbah18yIGxBxBlY6jQbKw975HTHcWjmhCuK2XhvfskfcAcj33cQ
Requested by: Host: simcast.com
URL: https://simcast.com/?d=timotolkki.net&pcid=802&rid=152&a=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7CCF 0
0 68ms
68ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Clg01r-WBY-GxFaatmLAPiYa0uAGm4NHfbM_Bx5TnEKf4076OLxABIIb3hiZglQKgAaTdmosDyAEB4AIAqAMByAMKqgT_AU_QJ_u83X9dZb8X8Kcw06-RAJAnheyzk-MXTSpBYRoZSuYmvd5Nakg-lw6AKOD8r1uv31_ujRmBIrHrXKj3TbqYQI0CPsqTMnX1AIJhteUcvEJk0eKp3BQws63TMIjSYMu5sNy2Sjy-Oi2uLz2uj_ThaVGjTIhnNa3foFAiGJTrHRznUp4tz3bS7FMIf_phTaIJow1BaTDngCxQhZZpr7NyEOTvkHwREnWrHJPl0c_f0aHr4kW9bTEz01L91u3fc3w5djn6zrisxfVkhjH-2n3eMUuUhnjCS9ZkoOXh7rXDBF-lCHUw6gbD7_KiTbvsdOELI4aa824L-kIWBOdjrcAE1tOzjYoE4AQBkgUECAQYAZIFBAgFGASAB8Si5XSoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBC0vxPSCBEIgOGAEBABGB0yAqoCOgKAQIAKA8gLAdgTDIgUAdAVAYAXAbIXHgocCAASFHB1Yi0xMDYyOTcyODYxNTUzMzAzGIHUHA&sigh=LPD1krICKNg&uach_m=[UACH]&cid=CAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM
Requested by: Host: simcast.com
URL: https://simcast.com/?d=timotolkki.net&pcid=802&rid=152&a=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 container.html Show response
a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5E8B 6 KB
3 KB 72ms
26ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:47 GMT
expires: Sun, 26 Nov 2023 10:08:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 489B 6 KB
3 KB 68ms
25ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:47 GMT
expires: Sun, 26 Nov 2023 10:08:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame EDF0 6 KB
3 KB 62ms
23ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:47 GMT
expires: Sun, 26 Nov 2023 10:08:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7CCF 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ec006492a69f71aa9ae0edd1e5a2d543e25182cddb60d091b330ac981968aaf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
329 B 58ms
49ms XHR
application/json 52.19.187.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.187.82 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-187-82.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 5709fd2596b091294f5c50306d42afaf3a3870ed5b65948000f7991d6667b18d

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.6.166
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 7CCF 28 KB
28 KB 70ms
27ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 21:35:41 GMT
x-content-type-options: nosniff
age: 131587
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Nov 2023 21:35:41 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1A41 624 B
242 B 63ms
59ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CICHEhC30jMYqrzKgQEwAQ&v=APEucNUniOO67Hh3FyAb4TRTCTiVa1-H-_hqaboWe2lAr0iJjymrZ7xblYGFloNtEDHci9jl0bICX6Wh5NOltRM0fKcrVH4tjjiv5WYlHqGPCF2cPTpnR7h5AMle3RGtdKq6NG2p37ca8DwaEBwIPnytgcCDBHuY50EhtV_2GEIN1GfQeg7It-y2eX0e2kALWWBxAb9elnYHsC6Y7iGRFSZnEFksMPmSSQ

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame EDF0 28 KB
16 KB 76ms
73ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AdUlT6Tvl-P_PSZivlOPzlvm2ekoxCQ-S9_2ZtvTkIzG84EPmTenSvXisRRxjwbSN1xYIGl9HFjqqwusfrZJqK4jvdBEJFzhYm9vVP7KPoUJKLYFzp5kj_RIBhJw-36ioqfbYOqCaRrS-x9tI_Yh4zVyrtTJ6EhS7d3kS44T_nc7cvtMk&cry=1&dbm_d=AKAmf-CarO_AuOrcRBlONdvkDJ5J5D6f66h6fC5m-EWLGar2KqcpzLGXwh4HZMYVDoFHHdstNDpm_hIO4Vri4EHgwtGYZ-6dEAS8u-92eMVS9uhiNC_YGoiKfw3IX8qzodagoyL-uXPtXkLX64-4PdhegHh-dTGEquUrv-WCA1q1TL80sgnuCQOen5qI4ZNWy8NWwJrz8w8tWAB74a-AsLxOvL7QX6OepuVDcjHvThRMMi8tQXPI-VFnbD6vz5YyL3SvcoWUy3KCzkNXLS48WsSpACDdk0JUwc6Gwook2QOMBQwzv0C8nUCW_TAWIHoNKjiFEq2M4xhXhMK5rzX9sDryHoctDIvXlyqL39SgYQzCqNB2-8_wQ1koMQbRY9AyeMQxxJSTOSaz5fJpDda35oJM8I3Hp62GthLW0hEj6xtB9HC0UT4odA1gzRrNRfoUugWAyROpMIHRK4-vqd8lcPDwP5ParCgej8qoaUNyIdPyPeXuirL0GjA7a_Ty1pyWyQDfCi5fqD9KEUW7xMR-BfnIZtJutkzeZ0M2uvCYKkWtBd4IkSMCtVuq-DhWwvMHWQO06fyn2KaUmfaKUyVk-5rJ7q-J_v8GiAJFOMP1FKacxJze6yQLdTRgMOwYbF76c6Ruf1ssgemtIOr61Oap3KXVXdmMRhHAfw67B7-LrIFBtrSy8KZM9onCRqWk1crtyjT3gF8QNNqZFnScnVCfFbGPoUvS6ecKbr8uKUrBGYjMN-LPBfZF9MZMXPwHfpU_a1sg2KFsX8bw53NwSbRhkxV3JIYw5-T1pl0NnHsLEKwN_MsHi3xgqocTmDS2hlnP_TexIkkhV7Eed8PwfjvaJ1Zqh5GAfRLJTtUF6HqrKzPiUAq1nFEkunYx8WPSvMPAZZiDEBLHlC3ELXMRCW5gLKZnU8bBKMOZ4kHZCLRxWpaiI4yBZITgN32ak5ImWdteJkm-lLxsU2qUj-rD15gwLPaMGVjvmcySXr0jGuzB_aqxKyPy18UofC4dzsIjrR3ZdQitTWl-v59H266UD2t5nQGt96EDkp8fC-4f-S8B3YH1Dp4eJrDlFxPPbDQ4e_hWSB3YAQ_8Heo6eUhmuVnS4HOk9V4IFvqFxgdYRvLX-JnJzccUbD8Z2dmeYlOTo-eLMMASfKKxBmkl-WAWp0mZsPl8NZQiT8ZcSRX6y2XPRYWmFt8i8zuGCmAiCXn7DrR4mlKy-HTY_2wVWgOI_jkD_xVnUNbSxxfO3KFvnzJ7W4n3O9S1OFihDxGRX5evywlOnYdTLde0xi_fNbThu1qMvdJLALbGhdMLSlQZZK5-KbwsLbW3vGgpHw5AsyT1nAIISeHE03hJRffsfwjcSDZQmHxBsxxjZ-3sEv66agPFSykYrubfVRMu198uf4eeD81v5N_1na05FBEnNzvaG_UrwD390P0lEejGMGloVyzwIQcjeDXZED_kct7LgBGYOT2kCCJcS0UvIFDsrxjz8oY0Up-FuqAxfc8C6gKO1XPTmoWH3yQ9gv_R6hd3ll11IFt8wMI4RfeMDdhixr9TeQy629mgdyeRrQ2vFyKvo1Lv01nQkTVUohfTp3fFGkGpkbvCitzAlf3R9gWKr583N8HFWAF4kBs80YXdTEyKBnqNJmfDSYLRA6fnYNkQWn5WcckGreFOyVukkNxlKWfjLbL-m4WKNj6ufNE2dxXTnl3-hsb3JS1hl1gx6p7QZywf0VGzkviqi9TQtMdqMU-Jyk0uOfxOiS_RUee5G7rkjCDarRjidDT1pOH84ridEmcgIwy3H5DDuK9OMFVzqFV0rz7e6nly0SeALEHQsYv3ab5EBgabv6ysnu7DndMa_RAkoHBiWZylBb4yXQTXI3k_dQRuWaDQRNTiyizKMbdSy9gIW7V8ljhoEeaplM-Q1uOPDqzelSkSYgsBZ4YpK32Xqanm15aGy6vkyKesXTD4ZrBhPntSuxfId_sAq4K0rXqsf2OJlGhHZhu81fKbh7WjZvDNU_cGAIW5h6CqF53JI1GlwNh_3lvKkbC16_q0A8T7vbuZPZmg9kVsmGM1z7FAdU4RzP4IfxjuA2nOBkN4HhP9CuTLu0bwmE1UzFgWGPTWxNjmBWJUq0zrYiLX4d-gcUvoprmZFqTD54LHHwiaahI__a6EV2H9vwAvnzMVJiuCw7L1lRIr3z6G1-pZbvKDliWMIKcVvQlhkHZ6kFVZtljZJTK28qIk2eRvh-zXC5EuKr7fMgQq2jdhUQeeChvsTDWliRgKMMJMZNLqQx3cAiNLfr8VeOo9X-VLq9IBXt61o4ipK4vNjl61WjO8_OiLV3mJCMkH313oWIl6AncBFd9gPLDgqoTG30kxmUgloEw_C0MWvFCDOVWzCPAan1HdclwugoXVA_i8crX2rNO970q_UCOIE-cxTM3osJ7laPVy2e9NC8r11i8OVnV9EtRQpCBHj19TbfIdvTGiumyQdmYmidOfQYXLzgFK4gxx2TMsSvdCY8RX9C9BqjzZkoKKr6KTQsJ4Ug3N7BKB7p4vGl3FFFBOOxfCpooAccNKGFzXvgXsofafz-aIvfKaArZtt_S6tnZJJKjAR_6y6TfN4ea3vw6xAEm3jpVSe3upDO2qjL5nsbIb4c-8PWLaaML4yXx8S4OXM8KePKRUBG6K8_5LUtXBFBcvcPRyedrp8HTl4yQ1JEN0x-7kQKltPX9osUZjs0CDHYUlvB2jRTJU4jB_GOyynGsgu-Qyc41EYxcCZicLEcX7FE0uQUKNPkwA2x71w0t1rc0uCLWLCsmVLpOjwLttKzroGVQBsK0IzpfknRSAIWhznSijAax5hxu-i-SkG1us1UoDjzicwE8yP6jG7kFR7Seoeu6eYwhKaWuz5EV_fc94HmbHIFxB0KsjN91QJcerrBYrvL7l-3er30b3jH2SqR8c4oq8qYPbuCrNxg_JlKIFNwV3mYGadcHCHaASstQpI3tDWIj3nc3z7YU_p6Y4SorqNhaPttBWOOjXE3Ymowx8sd_x_Tv3flYik21LuTd5VSq_BF45yL39-uV6XCgKGHLCXVfjz9u9L4XojssSVZQGYAf2LxgtTWemFmu-awOtXfxpJar60AGkGNNKv-xBIAGIMwKcvRsTkVb27-1ZVABr_3OBKUF9GaYc7WAO6yny9JaiLtQL2FNm0Ga2mZYMuCQI189prl-sm949afKb9ebjKUuAOpEeH_nsWxVDUy522dTOBw-MLQrFkzqh6dKm814ir7xMejkHYvv1RFfi93nRmlxGlMb64CCnisKBMwudgqOX5gv6ODAC0jXVsWcGwObh9vefVOU&cid=CAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Requested by

Host: www.timotolkki.net
URL: http://www.timotolkki.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b19db986f13932e7b1777e85deb5e01c625872ed7d1facbe87e9bb2a08d2b985

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16847
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDF0 42 B
63 B 58ms
56ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CXnii4qw86VWW6cRTFYiAjCjgRZV-ZVa9jR53scf2b0uvrPDZfn19AzsRkxhOiEdmzuNScECFSxAozlUqbYGcNdVvWGB0xsI0oINilsadk3SIH0Xo

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame EDF0 35 KB
13 KB 127ms
51ms Script
application/javascript 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9624c9f30634be84a224d007e5df178a51107bff3e456e2a90b504cbf350d190

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 22 Nov 2022 06:17:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 359442
etag: W/"49e3b0ffd5e74f27b691e89cf271d672"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d46Dufk4w%2Fpigzd2CuMYBSfrR6HSbHrPGaVp4tj46wb5AtYRumnW8YlkGgcTgMBQNt5r3C2ayMsgWmfdcKQ1cTxwgali7iD100BPXRg7Rs7aRAIqUcIl2Hu%2FmER8yBSPMgbZRcQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
cf-ray: 7701d32dac706937-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Tue, 22 Nov 2022 06:18:06 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame EDF0 3 KB
1 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 08:31:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5849
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 08:31:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame EDF0 18 KB
7 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 12:23:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Dec 2022 12:23:48 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame EDF0 0
0 34ms
32ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ_3aH8ZuwlrxxtTHL0uPqTLlmDURlkxKP9A9Mp6rfZ5Y9VWi82KbWbVUJLseIE4z2jPo6-_1CpnOnnyYpb7aXTdXMemQ
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EDF0 154 KB
48 KB 89ms
34ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 26 Nov 2022 10:08:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0567 640 B
262 B 64ms
57ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUfvRpuhwXXbhAjR6BHoZFUeypHDsD-sxgxZRT5o3AGlHQmQWEVaFTPWeFpnkX9Yd3vu-mLKO1bqjcb_1T6LNmWKJQ_c9GDBkTuq2pFyy-1E8EKM20ESX0pWQmYmg6f3UKgm-dieBayhrmVrfYTdvBR_gbO0MYCEYMYCjYMAI8Q94sWyIHG9MoGw3mnJkFgC_xiPVLJDE8xwsGY-tsP-UDs1ISbUQ

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 489B 15 KB
11 KB 61ms
59ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ci6IvdXTIV1o8Pj9lM3xzMthy63m8dTnZEohOYBxGkBpzXnthRlC1Bh7wE6o56GTp9yGmNL-dVLYTNm3k3vwCn5pWiCx2eTIIpq9q9cGraUdWPOelydkdWUP77XAoCO88QOTMlumjXrbYKgvKNhCZtQCsTn3640RzJod-Y5jM8dRe5n8k&cry=1&dbm_d=AKAmf-Cj2YlGjDgjB0rVZnZjSsVmxYwEXOUg5DHFkuHe8s9fWuwV08eC4shAzMFLnyTSYPp_yKxgZ0y-ECVL4cFLcD-WIr6EL38vYm4TttYPMUlWMF6ydV-p0LQA26bD15xsLPYiABZFXTIehaIUQjz2yUWgcTvLe4bgnKgmGolInnkOB_xgODZaxw41wqmjISZchSW711MryKrhjyFySzLQDTbZ8DzCuvFHf3LdQsnL5VdUHciN31CW255dRP2VD3bYdeO8RNhRbDlkhYRBhAfSLAPfpkbVBncL1e3dmRAt6eNgHv3JwkZacznD4-aRw63GbK5cskbXaT7D-9RZ_5pTmb33K-8BlkpIk5MUSvZENvg8QQfNL3wT9vu7aklEbpr8hJ1L9LbhRGgGUoN73BMqNRG8GxHEfgnPIcKCoJB9ro-BvvnqYMyZ2NmJYT6jb3GwBi0-SB9V8DKYiLmQiw220_X4RwU5RKso0Tm3U8d8plcsqcAcRFZjT4oT4iK5VgLyC6LqJFKsfPvfbNcmjrc7hRjPPs90leVVCu5G51tXJ_2vNkjThplIJJDPOWqOcdLfM0cT0r0v-fcJMhmCtUgc4yGafzw2fU2_xiiYKEKUdm46uQocfv5LxFxpYt5Nw68PpXS6HUBfvWDwc68dOb2f8E2kapJCuD_I7Q6s2vfKKl5FEUop366PNoM8rjaTeWH_3OqO-174NCqw120uSf-uohynzVnc4OruN4iBP7sC5VkX70FFylmw762Cdtw4uzN0C9TUZM-ovwoasep8UP3C6S3a57GMGE-vOXzOtp1DEUcGJqPOgK0E7Ap94DEesNfrHr8J2IZjJwyR19q65EBrldyIl2BrJnA6jWLEJ23Z8nyOn6il_sTL99VK8GFJnETd0t_ETzY6avkEpqO1JCtIR_kCm1CHGFYAj3lcRSC828HpOUNEr8Izg7Xs5TL-6M_CYpneDRLefo39bSS66NaoTwJj_eUiT_NQh2ogeBlQ6hyxSPR7FBbf7I96iYB4qnNSpG6qDnkD4sBAoKHM_6x99gzpJ4_V-IzrrW5DELoxsttqqpLCDndyoukcvx3RxXO8RgwB_Svm8WIdQwvJH4AcQf0QpNcaOwVHrT3xnn-Rib2ftATEOkmegikPx9nlPsf0GVqeL9OjkQTxK6gnZbMpPZkBk1_X9w2ijqcU3rXveogyYNaUtPG_D4hBJbvMumFQd-jMoK8GKHXONMJfHT0ZobFdqj-iaz6kQilLpixO9PqJ8Be3dBzGWkecxk1D6MxLhcRtyDuoUb0JUT_lX_feFKaInWqGuyntjTiYC31GeuLvpYlvKRYVAggmZzrtDSyr0NPgRJD0zyvypztsP8ADp8iL6VSThb9qFtz3OB3dl2Bd9O2PO8YYczyS-8Se_JzlIX8qL6pOJ9ya2BcoNraftzvMKdMa503M39jNPDdgF0x6pDbfxYWAR7Gd0tIUr84k9aCFnKd6poKj9PoxDoBN_pOaceNY-JZ5dw7Fp3zKjpQ5y3YFzojgQ_YXcY3-zGp3aVvRwIZ6jr6MlwWrt_5rzvkPzt-xWq-opeqJUuy_WLQ_fZfrQIYjWHD2AX-oGmisZkIdK_Te4PllHb0qxBdUx7W5cRKqGLPtw1yBmip9Ui_88nk__Mn9yGVbTZvE1ImiODS9ygbzjvkaFsM5xOywYrJOQhu5jpymclhIT6UFkuMPelI9Xl0-Hf0vVfHTJjUoUNwuYopkfMyu7AUHbiCkDHiVTt7dVzMX4nID833eVwwagnBhxbykuu_JUgDf8bguRWs4D3nFEMjdCwdR_zeeoeFfVfxb88Kfw_GX7ykS-RckiH9T0plGgYrcQ6jMfKxy8YQXh7rk4ktiIvJTCfbyQ0c_i4sCCvDyq42fyUsbxJvu7MdBjlAJ2Orbfjcd8GH_Gun9Q8pGiHR9k5UnFbTIslWBRlgkQkAy6xKya7rshwRksVmMTUR_TuKH5liiAEUZ1CXo3GlwmsCn_f6z3oKzWUjTOLOty4UTm4_rj_eMUxYTfsAx5xZPKRl8GU4iX4cXsf_260VM9XwpzsetTBWkK7lxMi6Vc3NfFnnbZcioWrw_mNlE-7zofHG6keSvHhJTYTNBNyvV_1k8r57FxIEgUbf8C2LSvqPz3qiFsP5WIuCcAodEXqWrv08JtHDvQU5qWH9acZGhcxaKBfX22hajQVgh92BWfRwjD9m3ASlh0kt8ZxjLdCXDhbbnMHFpLH34I0s3xFBbizii7u-nRT-5eEwwvqHhHBgrdOEEGSuU01NtQIfzsaTFX3e6n-WdCavrKdgfqUt8piJ5q7hEcgZprQOuIrf3ceyXfEDsx_6EXelPVfrNFphA55jxf7h8zCzjs7pHRr9cvz1WzwWyO6Qhkl2X5WvxukNLQ7utxi2BpOfPPMZm7KeItBv3LpQGf8gCDAHvtTiJgRUsKitkDtibPaucpv_X_WxDeFKltp0x9WFSUzYTWUdSLjew8Tsgm9xd98LoP7S5jfDYKqXgTuD-EEhPZXm0RvH-1Ud8rg4LOmoXajtmI5ta5L_Nv5fqBfTaFSe_ZJWoGa9Ojd_lt3xjGyNPg2xCtPiijFTGnsMP-0DJGz9dmkCK8LcM414FHFBJvXSkO6oFs6hu_zq3P0IArKVCzmrVSrwR2aklVWg74MktvOcittAMj7jUCJT7c39d6JeALiV0tv93d2P7bXFwAUXNi4frfIaTDnO8btBdpCZCxPuTiM0_TAoPyBjFrzVQ0oRZuTUwmRIS2ivd1HBlYGJZktmpOpZYSSFcXtCzWolzrPswWbMyhylrl9DttQY6k-dF-jEvoxIjVKz1jk8C0nQ_vyzT9dZ9D0lQ50w5NfpmKERrCZJA4mpDsUYD9r1QxDjyN5gxNBz1ZnllGJcFJbs05ra1wE3N5HPRfyIqmea0eIIByp-h8u28h0ePHIcAMdtkkoJZsO4I9z58SiPogjGwALGKamruCMOnbs0A1fAhXTn0VFa0GAidQoFyqvGBKstqpehM38qo1cbbpV_cZlQHkePR28va48-e3zupYa-bmnKLkUQXAx9CboXh1TjEc9SPskFqapbxsp3q4tjsbvcuqad8lVz7zFKmToZExtAwZ5zGaYtV8taNJn7MBhVDW602c1qnMhLmewb0LwJfxe81OdLnF8UDx10InooTDMvnLb_1tJNZpvqD9DDHQSka5aTkICvZUb5518VLQQXvAw0diy_FDRT8vKdsypqCE6ysmfTxeJxYdm9ovpjvE3Gmw44-dL6U01mfAZQbIcmNl5JCz9VT_JjC0TFstnrHFPoWgpo7V1ek2HOJhb0JmD5oHdnA43wC&cid=CAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Requested by

Host: www.timotolkki.net
URL: http://www.timotolkki.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ab8e52fb1bf4837b3dd34a1a397456e76014081acd692680c5b13d9324a65c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 489B 42 B
63 B 59ms
56ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DOe5vcn3MX5ckXM_srcHUF8p0oET1zqu6_gX_66diuWsZTLeBzbEJ-ldnc0HzSSVwSgfAwVFPNoUaf5Gawh64H55vU5HC_HknIh1eO2EbrwInTjk8

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 489B 3 KB
1 KB 29ms
27ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 08:31:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5849
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 08:31:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 489B 18 KB
7 KB 29ms
27ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 12:23:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Dec 2022 12:23:48 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 489B 0
0 32ms
30ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSdrVNTfNw8tr-J7qKMc0NB0SInCXRPkGCs_H85nHQ_Qmq_fU6e7U6K7xrfW-yntWRJu6caVk1CfpXM19a7X9PbmjsI4g
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 489B 154 KB
47 KB 117ms
66ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 26 Nov 2022 10:08:48 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5E8B 0
0 67ms
67ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C7ZmDr-WBY-OxFaatmLAPiYa0uAHJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItMTA2Mjk3Mjg2MTU1MzMwM8gBCakC_V3iep9wsT7gAgCoAwGqBPYBT9AUSF5Gg1rgr7CG5QuIQbbAuQzsn1VgpSYEBDJ1XK0-AIJo7Y0miUm1n3p2f_t1Cqo4A-AyQzu6TmCAoIi_m1KS5dHPBPbzk3NogZpBAEUehhJIjKrrCNUzKG76rnuSMfyvJxgxE7t52oA9U9mtOHvY6V5LgtMDHT_dLTY_d1UIjfhJJfg8c5lGaT9cz58cpJEJs9DKGZuzm5Vkzz7zrxEprxzNgofdYK1-YGB2icTk-MF-MSksB7RFdBVYHNBoZ10jtXA3wZS9VyVBLpILa-PoWM077gm9bNVBsIUB9YnEKDrRvW199YIfLZJ4t42lIzIibiIf4AQBgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi0xMDYyOTcyODYxNTUzMzAzGIHUHA&sigh=i2bRZmztHLQ&uach_m=[UACH]&cid=CAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM
Requested by: Host: www.timotolkki.net
URL: http://www.timotolkki.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame 5E8B 0
0 156ms
63ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=k5CTFLikCdACmAKdg2ICAgAAANzcIsRkPmti9TWInwk5jtsQr-WBYzfkCJlgaw2o3itoABIAAA&wp=Y4HlrwAFWOMABhamAA0DCQMvuEgGAVrEUkQa2g

Requested by

Host: www.timotolkki.net
URL: http://www.timotolkki.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:47 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 206444
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 4A1F 137 KB
47 KB 229ms
122ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y4HlrwAFWOMABhamAA0DCQMvuEgGAVrEUkQa2g&u=%7C7MxddUknimHH%2FClEdsK4cfw1RGB%2F%2FVaNDLwLJlNeAUA%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jvULOd3YfT8Kie5-AMuoqyTirKgE-lWZeo7Xkzl_-qONzvo5OuAh8Wye-WwROab7zsr3F-aRieyN3GBFyOnMAAO13pvh_PMvVGi46znF51M1la_GFccwBFquMloJY6zQEkFfovP9gvOndJjmX_pNlCStJYjDmXQ8VHaUeQS_-mSV30KKVfo94iHUE4b-PaFhYvnPOZWYQWqa28DlFdAeBeCab5R5QUwmyognhmkIOMrjOGrXtx3x8qKkqe6BeGX15O2A-hnP2EUDgdUfs-ztbsVRQEpfkMUGm48bC-9pyA4XCm1WxLDhJW9Cw-5zJGaaCLgHRYdVaLlHUt3P63-7ff6HTFQ1lmZvnU6CPsnVbtjQjnOkPx0UkJxwHgEs4WCkCaTR1AvInCMGnA0FqWRCO3scCz6eHR1kuTfZvJaZUdq_s9T3dP5oK94RxLrgt9uJBWYID8145pgbMnm6qQ-xCrYCEQH4zQTqBIINQHsE6pRCO5638OUbuWX-COdnr5fkYEjEQtz5f4vRIMifSn0y-py7BVFF9r7FvoRu-mxS4kyFpsY4oPICmOutfWybLI28thPE5ZcIG6UVa6MER-99RMI&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCiM2Xr-WBY-OxFaatmLAPiYa0uAHJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItMTA2Mjk3Mjg2MTU1MzMwM8gBCakC_V3iep9wsT7gAgCoAwGqBPkBT9AUSF5Gg1rgr7CG5QuIQbbAuQzsn1VgpSYEBDJ1XK0-AIJo7Y0miUm1n3p2f_t1Cqo4A-AyQzu6TmCAoIi_m1KS5dHPBPbzk3NogZpBAEUehhJIjKrrCNUzKG76rnuSMfyvJxgxE7t52oA9U9mtOHvY6V5LgtMDHT_dLTY_d1UIjfhJJfg8c5lGaT9cz58cpJEJs9DKGZuzm5Vkzz7zrxEprxzNgofdYK1-YGB2icTk-MF-MSksB7RFdBVYHNBoZ10jtXA3wZS9VyVBLpILa6HqeV-8YZWu00lVE1U8U3HNPDBnt0NldzbXEDSKCJOJO7eI6jGgQ0184AQBgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0cG0KpuOH1dVx5WPeu5SDK1uaRkw%26client%3Dca-pub-1062972861553303%26adurl%3D

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

8137f3b8c146e1659d8f57e724f10770850271905af3dcabbc214f7b3b540663

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:47 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=3nV-DsdzwNOoML8htW_skJBHuNDMNzJVhLAkrkPUTgSBRTQ51_c6GdPhpDUgCLBiE6siPp_D7Oji1YH4TCnDS3C28Qm8B4k4gf6apv4M8G2ju1DaKYHLy6UOz8dIch24--w095LSSuSFIcxhKwzduvxd97Q6TfjAu9fB5Kwd5TNnu54MDW7koW0HT_vTtJiwUH2wLlbG0uXapUH9vCqtnQI3Ts_PBQayH2GEQmpivpbSFixzMpARXHYS8mgt1K82Q1aeRA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 72736565
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 5E8B 3 KB
1 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 08:31:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5849
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Dec 2022 08:31:19 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E9B5 1 KB
643 B 24ms
23ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 65552
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 25 Nov 2022 15:56:16 GMT
etag: 48472445140208031
expires: Sat, 26 Nov 2022 15:56:16 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 5E8B 18 KB
7 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 12:23:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Dec 2022 12:23:48 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5E8B 0
0 32ms
30ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRceLErhRY0_qGkk70VNBitr8JjIMxP1t5YXGhqucxl_u9Sjk3yQQtRXpaceeNRHO2fuOeXh3hA4F6fE9rjd2fpDTRZSA
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 5E8B 24 KB
6 KB 28ms
26ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Wed, 23 Nov 2022 11:28:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 254409
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 23 Nov 2023 11:28:39 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5E8B 154 KB
47 KB 127ms
85ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 26 Nov 2022 10:08:48 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 9ECA
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=simcast.com&sn=ChromeSyncframe&so=0&topUrl=simcast.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=pMaTJnxMTG40TldYNTgvZ3NsWVFRVk1OUU51NXk1MzEzVnR1SGFIVzNMTVRwVXZxUDMvdTNCek8rRDFiSk1LaUkrL2ZTSzdueVg4T002dUsyUVJzZnkvc0pLOWpScDlhTzlxck5WaUdxQTlSS203WXlrZU11M3RDMk93Ql...

435 B
652 B

110ms
32ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=pMaTJnxMTG40TldYNTgvZ3NsWVFRVk1OUU51NXk1MzEzVnR1SGFIVzNMTVRwVXZxUDMvdTNCek8rRDFiSk1LaUkrL2ZTSzdueVg4T002dUsyUVJzZnkvc0pLOWpScDlhTzlxck5WaUdxQTlSS203WXlrZU11M3RDMk93QlNaZXhHeGZhWVZDYWt1NEVZMlVPRXFJaFVHZEF6ZlI2N0FuRXZzaFVBaVU1TjVCOVJOK2Y4SWpZazNDbXZ6Yll2MjB2TlZhMmpRQWdiWnpUUjlJYUNnVXdxRXN5NTRCSzhHRVd0dUJkRkFVa29CZTF1WmgzVVp0NmZEUXNxUHBQTzBzUWlNcVVjak51aW4yQ1I0eWVkQy85UDF1eTdNQT09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

d564e8f6b81d3dc500818d94114dd2d2b9d31436debe8e5034606361ed50e20c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:47 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1434389
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=pMaTJnxMTG40TldYNTgvZ3NsWVFRVk1OUU51NXk1MzEzVnR1SGFIVzNMTVRwVXZxUDMvdTNCek8rRDFiSk1LaUkrL2ZTSzdueVg4T002dUsyUVJzZnkvc0pLOWpScDlhTzlxck5WaUdxQTlSS203WXlrZU11M3RDMk93QlNaZXhHeGZhWVZDYWt1NEVZMlVPRXFJaFVHZEF6ZlI2N0FuRXZzaFVBaVU1TjVCOVJOK2Y4SWpZazNDbXZ6Yll2MjB2TlZhMmpRQWdiWnpUUjlJYUNnVXdxRXN5NTRCSzhHRVd0dUJkRkFVa29CZTF1WmgzVVp0NmZEUXNxUHBQTzBzUWlNcVVjak51aW4yQ1I0eWVkQy85UDF1eTdNQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 575171
content-length: 0
expires: 0

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
320 B 27ms
23ms XHR
text/plain 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 , France, ASN16276 (OVH, FR),

Reverse DNS

959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1A41
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK6AIi2W6BgOUqsvvb5NNRE&google_cver=1

43 B
766 B

24ms
24ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK6AIi2W6BgOUqsvvb5NNRE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICHEhC30jMYqrzKgQEwAQ&v=APEucNUniOO67Hh3FyAb4TRTCTiVa1-H-_hqaboWe2lAr0iJjymrZ7xblYGFloNtEDHci9jl0bICX6Wh5NOltRM0fKcrVH4tjjiv5WYlHqGPCF2cPTpnR7h5AMle3RGtdKq6NG2p37ca8DwaEBwIPnytgcCDBHuY50EhtV_2GEIN1GfQeg7It-y2eX0e2kALWWBxAb9elnYHsC6Y7iGRFSZnEFksMPmSSQ
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 26 Nov 2022 10:08:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK6AIi2W6BgOUqsvvb5NNRE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1A41
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4HlsJm95hzW.femBIQXPgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK6AIi2W6BgOUqsvvb5NNRE&google_cver=1&google_hm=2

43 B
894 B

26ms
25ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK6AIi2W6BgOUqsvvb5NNRE&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICHEhC30jMYqrzKgQEwAQ&v=APEucNUniOO67Hh3FyAb4TRTCTiVa1-H-_hqaboWe2lAr0iJjymrZ7xblYGFloNtEDHci9jl0bICX6Wh5NOltRM0fKcrVH4tjjiv5WYlHqGPCF2cPTpnR7h5AMle3RGtdKq6NG2p37ca8DwaEBwIPnytgcCDBHuY50EhtV_2GEIN1GfQeg7It-y2eX0e2kALWWBxAb9elnYHsC6Y7iGRFSZnEFksMPmSSQ
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 26 Nov 2022 10:08:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK6AIi2W6BgOUqsvvb5NNRE&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 1A41
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJBu7s8v59whbtm57aY_2Q8&google_cver=1

43 B
1020 B

32ms
30ms

Image
image/gif

185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEJBu7s8v59whbtm57aY_2Q8&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CICHEhC30jMYqrzKgQEwAQ&v=APEucNUniOO67Hh3FyAb4TRTCTiVa1-H-_hqaboWe2lAr0iJjymrZ7xblYGFloNtEDHci9jl0bICX6Wh5NOltRM0fKcrVH4tjjiv5WYlHqGPCF2cPTpnR7h5AMle3RGtdKq6NG2p37ca8DwaEBwIPnytgcCDBHuY50EhtV_2GEIN1GfQeg7It-y2eX0e2kALWWBxAb9elnYHsC6Y7iGRFSZnEFksMPmSSQ

Protocol

HTTP/1.1

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 26 Nov 2022 10:08:48 GMT
AN-X-Request-Uuid: 3cc4333f-49d0-4a29-a466-de950d585103
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEJBu7s8v59whbtm57aY_2Q8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1A41
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzMyMjcxMTIxMTA2MDE3ODk0Mg%3D%3D

170 B
188 B

89ms
36ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzMyMjcxMTIxMTA2MDE3ODk0Mg%3D%3D

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 26 Nov 2022 10:08:48 GMT
AN-X-Request-Uuid: 4bcef324-441a-49ca-a8bd-09cf4576670a
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzMyMjcxMTIxMTA2MDE3ODk0Mg%3D%3D
Connection: keep-alive
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 7CCF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

42ms
40ms

Image
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: simcast.com
URL: https://simcast.com/?d=timotolkki.net&pcid=802&rid=152&a=0
Protocol: H3
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Redirect headers

date: Sat, 26 Nov 2022 10:08:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 0567
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJc8mkx5gYBleTV2kosIiYE&google_cver=1

43 B
61 B

57ms
32ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJc8mkx5gYBleTV2kosIiYE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUfvRpuhwXXbhAjR6BHoZFUeypHDsD-sxgxZRT5o3AGlHQmQWEVaFTPWeFpnkX9Yd3vu-mLKO1bqjcb_1T6LNmWKJQ_c9GDBkTuq2pFyy-1E8EKM20ESX0pWQmYmg6f3UKgm-dieBayhrmVrfYTdvBR_gbO0MYCEYMYCjYMAI8Q94sWyIHG9MoGw3mnJkFgC_xiPVLJDE8xwsGY-tsP-UDs1ISbUQ
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEJc8mkx5gYBleTV2kosIiYE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 0567 43 B
304 B 87ms
31ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUfvRpuhwXXbhAjR6BHoZFUeypHDsD-sxgxZRT5o3AGlHQmQWEVaFTPWeFpnkX9Yd3vu-mLKO1bqjcb_1T6LNmWKJQ_c9GDBkTuq2pFyy-1E8EKM20ESX0pWQmYmg6f3UKgm-dieBayhrmVrfYTdvBR_gbO0MYCEYMYCjYMAI8Q94sWyIHG9MoGw3mnJkFgC_xiPVLJDE8xwsGY-tsP-UDs1ISbUQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 0567
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESENRzLeV8TeBWYAh7dIxSeos&google_cver=1

23 B
172 B

52ms
51ms

Image
image/gif

184.31.88.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESENRzLeV8TeBWYAh7dIxSeos&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUfvRpuhwXXbhAjR6BHoZFUeypHDsD-sxgxZRT5o3AGlHQmQWEVaFTPWeFpnkX9Yd3vu-mLKO1bqjcb_1T6LNmWKJQ_c9GDBkTuq2pFyy-1E8EKM20ESX0pWQmYmg6f3UKgm-dieBayhrmVrfYTdvBR_gbO0MYCEYMYCjYMAI8Q94sWyIHG9MoGw3mnJkFgC_xiPVLJDE8xwsGY-tsP-UDs1ISbUQ
Protocol: H2
Server: 184.31.88.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-88-106.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

expires: Sat, 26 Nov 2022 10:08:48 GMT
pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESENRzLeV8TeBWYAh7dIxSeos&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 0567 23 B
172 B 124ms
47ms Image
image/gif 184.31.88.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUfvRpuhwXXbhAjR6BHoZFUeypHDsD-sxgxZRT5o3AGlHQmQWEVaFTPWeFpnkX9Yd3vu-mLKO1bqjcb_1T6LNmWKJQ_c9GDBkTuq2pFyy-1E8EKM20ESX0pWQmYmg6f3UKgm-dieBayhrmVrfYTdvBR_gbO0MYCEYMYCjYMAI8Q94sWyIHG9MoGw3mnJkFgC_xiPVLJDE8xwsGY-tsP-UDs1ISbUQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.88.106 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-88-106.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

expires: Sat, 26 Nov 2022 10:08:48 GMT
pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 489B 41 KB
15 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ci6IvdXTIV1o8Pj9lM3xzMthy63m8dTnZEohOYBxGkBpzXnthRlC1Bh7wE6o56GTp9yGmNL-dVLYTNm3k3vwCn5pWiCx2eTIIpq9q9cGraUdWPOelydkdWUP77XAoCO88QOTMlumjXrbYKgvKNhCZtQCsTn3640RzJod-Y5jM8dRe5n8k&cry=1&dbm_d=AKAmf-Cj2YlGjDgjB0rVZnZjSsVmxYwEXOUg5DHFkuHe8s9fWuwV08eC4shAzMFLnyTSYPp_yKxgZ0y-ECVL4cFLcD-WIr6EL38vYm4TttYPMUlWMF6ydV-p0LQA26bD15xsLPYiABZFXTIehaIUQjz2yUWgcTvLe4bgnKgmGolInnkOB_xgODZaxw41wqmjISZchSW711MryKrhjyFySzLQDTbZ8DzCuvFHf3LdQsnL5VdUHciN31CW255dRP2VD3bYdeO8RNhRbDlkhYRBhAfSLAPfpkbVBncL1e3dmRAt6eNgHv3JwkZacznD4-aRw63GbK5cskbXaT7D-9RZ_5pTmb33K-8BlkpIk5MUSvZENvg8QQfNL3wT9vu7aklEbpr8hJ1L9LbhRGgGUoN73BMqNRG8GxHEfgnPIcKCoJB9ro-BvvnqYMyZ2NmJYT6jb3GwBi0-SB9V8DKYiLmQiw220_X4RwU5RKso0Tm3U8d8plcsqcAcRFZjT4oT4iK5VgLyC6LqJFKsfPvfbNcmjrc7hRjPPs90leVVCu5G51tXJ_2vNkjThplIJJDPOWqOcdLfM0cT0r0v-fcJMhmCtUgc4yGafzw2fU2_xiiYKEKUdm46uQocfv5LxFxpYt5Nw68PpXS6HUBfvWDwc68dOb2f8E2kapJCuD_I7Q6s2vfKKl5FEUop366PNoM8rjaTeWH_3OqO-174NCqw120uSf-uohynzVnc4OruN4iBP7sC5VkX70FFylmw762Cdtw4uzN0C9TUZM-ovwoasep8UP3C6S3a57GMGE-vOXzOtp1DEUcGJqPOgK0E7Ap94DEesNfrHr8J2IZjJwyR19q65EBrldyIl2BrJnA6jWLEJ23Z8nyOn6il_sTL99VK8GFJnETd0t_ETzY6avkEpqO1JCtIR_kCm1CHGFYAj3lcRSC828HpOUNEr8Izg7Xs5TL-6M_CYpneDRLefo39bSS66NaoTwJj_eUiT_NQh2ogeBlQ6hyxSPR7FBbf7I96iYB4qnNSpG6qDnkD4sBAoKHM_6x99gzpJ4_V-IzrrW5DELoxsttqqpLCDndyoukcvx3RxXO8RgwB_Svm8WIdQwvJH4AcQf0QpNcaOwVHrT3xnn-Rib2ftATEOkmegikPx9nlPsf0GVqeL9OjkQTxK6gnZbMpPZkBk1_X9w2ijqcU3rXveogyYNaUtPG_D4hBJbvMumFQd-jMoK8GKHXONMJfHT0ZobFdqj-iaz6kQilLpixO9PqJ8Be3dBzGWkecxk1D6MxLhcRtyDuoUb0JUT_lX_feFKaInWqGuyntjTiYC31GeuLvpYlvKRYVAggmZzrtDSyr0NPgRJD0zyvypztsP8ADp8iL6VSThb9qFtz3OB3dl2Bd9O2PO8YYczyS-8Se_JzlIX8qL6pOJ9ya2BcoNraftzvMKdMa503M39jNPDdgF0x6pDbfxYWAR7Gd0tIUr84k9aCFnKd6poKj9PoxDoBN_pOaceNY-JZ5dw7Fp3zKjpQ5y3YFzojgQ_YXcY3-zGp3aVvRwIZ6jr6MlwWrt_5rzvkPzt-xWq-opeqJUuy_WLQ_fZfrQIYjWHD2AX-oGmisZkIdK_Te4PllHb0qxBdUx7W5cRKqGLPtw1yBmip9Ui_88nk__Mn9yGVbTZvE1ImiODS9ygbzjvkaFsM5xOywYrJOQhu5jpymclhIT6UFkuMPelI9Xl0-Hf0vVfHTJjUoUNwuYopkfMyu7AUHbiCkDHiVTt7dVzMX4nID833eVwwagnBhxbykuu_JUgDf8bguRWs4D3nFEMjdCwdR_zeeoeFfVfxb88Kfw_GX7ykS-RckiH9T0plGgYrcQ6jMfKxy8YQXh7rk4ktiIvJTCfbyQ0c_i4sCCvDyq42fyUsbxJvu7MdBjlAJ2Orbfjcd8GH_Gun9Q8pGiHR9k5UnFbTIslWBRlgkQkAy6xKya7rshwRksVmMTUR_TuKH5liiAEUZ1CXo3GlwmsCn_f6z3oKzWUjTOLOty4UTm4_rj_eMUxYTfsAx5xZPKRl8GU4iX4cXsf_260VM9XwpzsetTBWkK7lxMi6Vc3NfFnnbZcioWrw_mNlE-7zofHG6keSvHhJTYTNBNyvV_1k8r57FxIEgUbf8C2LSvqPz3qiFsP5WIuCcAodEXqWrv08JtHDvQU5qWH9acZGhcxaKBfX22hajQVgh92BWfRwjD9m3ASlh0kt8ZxjLdCXDhbbnMHFpLH34I0s3xFBbizii7u-nRT-5eEwwvqHhHBgrdOEEGSuU01NtQIfzsaTFX3e6n-WdCavrKdgfqUt8piJ5q7hEcgZprQOuIrf3ceyXfEDsx_6EXelPVfrNFphA55jxf7h8zCzjs7pHRr9cvz1WzwWyO6Qhkl2X5WvxukNLQ7utxi2BpOfPPMZm7KeItBv3LpQGf8gCDAHvtTiJgRUsKitkDtibPaucpv_X_WxDeFKltp0x9WFSUzYTWUdSLjew8Tsgm9xd98LoP7S5jfDYKqXgTuD-EEhPZXm0RvH-1Ud8rg4LOmoXajtmI5ta5L_Nv5fqBfTaFSe_ZJWoGa9Ojd_lt3xjGyNPg2xCtPiijFTGnsMP-0DJGz9dmkCK8LcM414FHFBJvXSkO6oFs6hu_zq3P0IArKVCzmrVSrwR2aklVWg74MktvOcittAMj7jUCJT7c39d6JeALiV0tv93d2P7bXFwAUXNi4frfIaTDnO8btBdpCZCxPuTiM0_TAoPyBjFrzVQ0oRZuTUwmRIS2ivd1HBlYGJZktmpOpZYSSFcXtCzWolzrPswWbMyhylrl9DttQY6k-dF-jEvoxIjVKz1jk8C0nQ_vyzT9dZ9D0lQ50w5NfpmKERrCZJA4mpDsUYD9r1QxDjyN5gxNBz1ZnllGJcFJbs05ra1wE3N5HPRfyIqmea0eIIByp-h8u28h0ePHIcAMdtkkoJZsO4I9z58SiPogjGwALGKamruCMOnbs0A1fAhXTn0VFa0GAidQoFyqvGBKstqpehM38qo1cbbpV_cZlQHkePR28va48-e3zupYa-bmnKLkUQXAx9CboXh1TjEc9SPskFqapbxsp3q4tjsbvcuqad8lVz7zFKmToZExtAwZ5zGaYtV8taNJn7MBhVDW602c1qnMhLmewb0LwJfxe81OdLnF8UDx10InooTDMvnLb_1tJNZpvqD9DDHQSka5aTkICvZUb5518VLQQXvAw0diy_FDRT8vKdsypqCE6ysmfTxeJxYdm9ovpjvE3Gmw44-dL6U01mfAZQbIcmNl5JCz9VT_JjC0TFstnrHFPoWgpo7V1ek2HOJhb0JmD5oHdnA43wC&cid=CAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 23:12:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39387
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 25 Nov 2023 23:12:21 GMT

GET
DATA 200
OK truncated
/ Frame 5E8B 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5080ddbcbb1c4893fc24ec5692b42e6b78dcf6352432332b7efcf03112ece8a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame E9B5 35 B
463 B 89ms
24ms Image
image/gif 2620:116:800d:21:93ca:31d8:d86e:38f6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJds_r20Pmfggd9yQVTOSFM&google_cver=1&google_push=ASkJ3FbKgz9gnezKseq2rOMVjxHQghHqLYmPe0HwqUPZ_poSMHtwdRAO-K9-FPqo_ZGNTGpERJVqxFsoKX8xmNQJfS5Jw_rBH2ul

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:93ca:31d8:d86e:38f6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E9B5
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESENKHtsUauHnIDjr8AyWkx6E&google_cver=1&google_push=ASkJ3FZnE5Q3ldkcmD58o6KxkPQ6tD_Wt16GtAxkJ6TSTcLMRRwggRxQ9jmvdh7bL-IjsVB0xv_ioTLhuRy...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ASkJ3FZnE5Q3ldkcmD58o6KxkPQ6tD_Wt16GtAxkJ6TSTcLMRRwggRxQ9jmvdh7bL-IjsVB0xv_ioTLhuRyArMbuIYYwq7q_umMU&google_hm=azNidpyTTo6eOh80tMhVgoU

170 B
188 B

51ms
34ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ASkJ3FZnE5Q3ldkcmD58o6KxkPQ6tD_Wt16GtAxkJ6TSTcLMRRwggRxQ9jmvdh7bL-IjsVB0xv_ioTLhuRyArMbuIYYwq7q_umMU&google_hm=azNidpyTTo6eOh80tMhVgoU

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ASkJ3FZnE5Q3ldkcmD58o6KxkPQ6tD_Wt16GtAxkJ6TSTcLMRRwggRxQ9jmvdh7bL-IjsVB0xv_ioTLhuRyArMbuIYYwq7q_umMU&google_hm=azNidpyTTo6eOh80tMhVgoU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E9B5
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEK4M7HM9Tm0Q4EqpmOL0IR0&google_cver=1&google_push=ASkJ3FZ_8WkDhbTQDwFMX0q6QTqIHbzNqRMdtE6AuytL68tc5NzOkgVgbXQeJHAudPPmbTvwcjqe0Ej2V6Uy90...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MDI2NDYyNTgzNzcwMTI2OA%3D%3D&google_push=ASkJ3FZ_8WkDhbTQDwFMX0q6QTqIHbzNqRMdtE6AuytL68tc5NzOkgVgbXQeJHAudPPmbTvwcjqe0Ej2V6Uy90WwL0...

170 B
188 B

86ms
37ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MDI2NDYyNTgzNzcwMTI2OA%3D%3D&google_push=ASkJ3FZ_8WkDhbTQDwFMX0q6QTqIHbzNqRMdtE6AuytL68tc5NzOkgVgbXQeJHAudPPmbTvwcjqe0Ej2V6Uy90WwL044yh1vA5h2

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MDI2NDYyNTgzNzcwMTI2OA%3D%3D&google_push=ASkJ3FZ_8WkDhbTQDwFMX0q6QTqIHbzNqRMdtE6AuytL68tc5NzOkgVgbXQeJHAudPPmbTvwcjqe0Ej2V6Uy90WwL044yh1vA5h2
Date: Sat, 26 Nov 2022 10:08:48 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E9B5
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEFQ82Hk-6wyisteK1uj81-k&google_cver=1&google_push=ASkJ3FbbZG_XpVql4QR34HdrASBFNev1SCVMppPYZFwkInOYnsuEfAuLse0_PgXHJPZJnYojh-Zt7BGajBYG3oyMNGXalKw...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ASkJ3FbbZG_XpVql4QR34HdrASBFNev1SCVMppPYZFwkInOYnsuEfAuLse0_PgXHJPZJnYojh-Zt7BGajBYG3oyMNGXalKwxcVDA&google_hm=NzkwMTIyMjkzMTY2NDc3MT...

170 B
188 B

46ms
45ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ASkJ3FbbZG_XpVql4QR34HdrASBFNev1SCVMppPYZFwkInOYnsuEfAuLse0_PgXHJPZJnYojh-Zt7BGajBYG3oyMNGXalKwxcVDA&google_hm=NzkwMTIyMjkzMTY2NDc3MTQ3Mg%3D%3D

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ASkJ3FbbZG_XpVql4QR34HdrASBFNev1SCVMppPYZFwkInOYnsuEfAuLse0_PgXHJPZJnYojh-Zt7BGajBYG3oyMNGXalKwxcVDA&google_hm=NzkwMTIyMjkzMTY2NDc3MTQ3Mg%3D%3D
content-length: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame E9B5 43 B
351 B 94ms
31ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESED7kFfZ5KgDQuM2Jri4NTGI&google_cver=1&google_push=ASkJ3FYCYh0L9TZntTS5ms7eY1CAWnaM02_rpz5FdKNDwvGQI7_ki_PTBz8_2DpLamvdVgnOLTSJWqw6bVz7qXWNEa5Orkv5Y2Y
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:47 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: mjveqcn8hg4rtvuc57q0jsho2l5ki03v

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E9B5
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFoqUBLFeQr1M1jSmENL6V0&google_cver=1&google_push=ASkJ3FazCdt5pQZYmNL4DJyPwCDYAgocmrFh_AA-Aon8Oo5QFPzHMQDDPi-oUyUcxy8jXayCiJR...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFYUlNFVUItTS04WUhQ&google_push=ASkJ3FazCdt5pQZYmNL4DJyPwCDYAgocmrFh_AA-Aon8Oo5QFPzHMQDDPi-oUyUcxy8jXayCiJRgnL4bAII42rpEV3EWI60z2ErA

170 B
188 B

36ms
35ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFYUlNFVUItTS04WUhQ&google_push=ASkJ3FazCdt5pQZYmNL4DJyPwCDYAgocmrFh_AA-Aon8Oo5QFPzHMQDDPi-oUyUcxy8jXayCiJRgnL4bAII42rpEV3EWI60z2ErA

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFYUlNFVUItTS04WUhQ&google_push=ASkJ3FazCdt5pQZYmNL4DJyPwCDYAgocmrFh_AA-Aon8Oo5QFPzHMQDDPi-oUyUcxy8jXayCiJRgnL4bAII42rpEV3EWI60z2ErA
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E9B5
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_push=AS...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_hm=Y4HlsJm95hzW-femBIQXPgAADSkAAAIB&google_nid=index&google_push=ASkJ3FY8V0Cpt0AiIrh722V_vxKsrJe9D4FoE...

170 B
188 B

38ms
37ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_hm=Y4HlsJm95hzW-femBIQXPgAADSkAAAIB&google_nid=index&google_push=ASkJ3FY8V0Cpt0AiIrh722V_vxKsrJe9D4FoERuUKiL6DQYJS93wcnsHy_9gNIzvn2j4gzjURpyHbyPqNJ2TjE0wJhXj6ytujBmW

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8DIq2AI4PIWQsWiWz0FT3dx8N3h2HQwSbTu3p15eU51pWx7FwyoY8tKz8WZdv5vAUbeaTNYPb%2BTF1NLoHtC%2BIZZOMoQAGF2EyBpfkifQcZj4s5AiIvGFJwVtWNpap9Niz8%2B4aUSQtqBcIg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_hm=Y4HlsJm95hzW-femBIQXPgAADSkAAAIB&google_nid=index&google_push=ASkJ3FY8V0Cpt0AiIrh722V_vxKsrJe9D4FoERuUKiL6DQYJS93wcnsHy_9gNIzvn2j4gzjURpyHbyPqNJ2TjE0wJhXj6ytujBmW
cache-control: no-cache
cf-ray: 7701d32f392f9945-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame E9B5 0
232 B 59ms
32ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KRLmUMHtkCU0QhoJ5J3yUYIOTAotJZkMUqm-BqY1_iMIouGYgOfTIx_FlGLRxXKqzN57Tp

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame EDF0 29 KB
11 KB 31ms
28ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AdUlT6Tvl-P_PSZivlOPzlvm2ekoxCQ-S9_2ZtvTkIzG84EPmTenSvXisRRxjwbSN1xYIGl9HFjqqwusfrZJqK4jvdBEJFzhYm9vVP7KPoUJKLYFzp5kj_RIBhJw-36ioqfbYOqCaRrS-x9tI_Yh4zVyrtTJ6EhS7d3kS44T_nc7cvtMk&cry=1&dbm_d=AKAmf-CarO_AuOrcRBlONdvkDJ5J5D6f66h6fC5m-EWLGar2KqcpzLGXwh4HZMYVDoFHHdstNDpm_hIO4Vri4EHgwtGYZ-6dEAS8u-92eMVS9uhiNC_YGoiKfw3IX8qzodagoyL-uXPtXkLX64-4PdhegHh-dTGEquUrv-WCA1q1TL80sgnuCQOen5qI4ZNWy8NWwJrz8w8tWAB74a-AsLxOvL7QX6OepuVDcjHvThRMMi8tQXPI-VFnbD6vz5YyL3SvcoWUy3KCzkNXLS48WsSpACDdk0JUwc6Gwook2QOMBQwzv0C8nUCW_TAWIHoNKjiFEq2M4xhXhMK5rzX9sDryHoctDIvXlyqL39SgYQzCqNB2-8_wQ1koMQbRY9AyeMQxxJSTOSaz5fJpDda35oJM8I3Hp62GthLW0hEj6xtB9HC0UT4odA1gzRrNRfoUugWAyROpMIHRK4-vqd8lcPDwP5ParCgej8qoaUNyIdPyPeXuirL0GjA7a_Ty1pyWyQDfCi5fqD9KEUW7xMR-BfnIZtJutkzeZ0M2uvCYKkWtBd4IkSMCtVuq-DhWwvMHWQO06fyn2KaUmfaKUyVk-5rJ7q-J_v8GiAJFOMP1FKacxJze6yQLdTRgMOwYbF76c6Ruf1ssgemtIOr61Oap3KXVXdmMRhHAfw67B7-LrIFBtrSy8KZM9onCRqWk1crtyjT3gF8QNNqZFnScnVCfFbGPoUvS6ecKbr8uKUrBGYjMN-LPBfZF9MZMXPwHfpU_a1sg2KFsX8bw53NwSbRhkxV3JIYw5-T1pl0NnHsLEKwN_MsHi3xgqocTmDS2hlnP_TexIkkhV7Eed8PwfjvaJ1Zqh5GAfRLJTtUF6HqrKzPiUAq1nFEkunYx8WPSvMPAZZiDEBLHlC3ELXMRCW5gLKZnU8bBKMOZ4kHZCLRxWpaiI4yBZITgN32ak5ImWdteJkm-lLxsU2qUj-rD15gwLPaMGVjvmcySXr0jGuzB_aqxKyPy18UofC4dzsIjrR3ZdQitTWl-v59H266UD2t5nQGt96EDkp8fC-4f-S8B3YH1Dp4eJrDlFxPPbDQ4e_hWSB3YAQ_8Heo6eUhmuVnS4HOk9V4IFvqFxgdYRvLX-JnJzccUbD8Z2dmeYlOTo-eLMMASfKKxBmkl-WAWp0mZsPl8NZQiT8ZcSRX6y2XPRYWmFt8i8zuGCmAiCXn7DrR4mlKy-HTY_2wVWgOI_jkD_xVnUNbSxxfO3KFvnzJ7W4n3O9S1OFihDxGRX5evywlOnYdTLde0xi_fNbThu1qMvdJLALbGhdMLSlQZZK5-KbwsLbW3vGgpHw5AsyT1nAIISeHE03hJRffsfwjcSDZQmHxBsxxjZ-3sEv66agPFSykYrubfVRMu198uf4eeD81v5N_1na05FBEnNzvaG_UrwD390P0lEejGMGloVyzwIQcjeDXZED_kct7LgBGYOT2kCCJcS0UvIFDsrxjz8oY0Up-FuqAxfc8C6gKO1XPTmoWH3yQ9gv_R6hd3ll11IFt8wMI4RfeMDdhixr9TeQy629mgdyeRrQ2vFyKvo1Lv01nQkTVUohfTp3fFGkGpkbvCitzAlf3R9gWKr583N8HFWAF4kBs80YXdTEyKBnqNJmfDSYLRA6fnYNkQWn5WcckGreFOyVukkNxlKWfjLbL-m4WKNj6ufNE2dxXTnl3-hsb3JS1hl1gx6p7QZywf0VGzkviqi9TQtMdqMU-Jyk0uOfxOiS_RUee5G7rkjCDarRjidDT1pOH84ridEmcgIwy3H5DDuK9OMFVzqFV0rz7e6nly0SeALEHQsYv3ab5EBgabv6ysnu7DndMa_RAkoHBiWZylBb4yXQTXI3k_dQRuWaDQRNTiyizKMbdSy9gIW7V8ljhoEeaplM-Q1uOPDqzelSkSYgsBZ4YpK32Xqanm15aGy6vkyKesXTD4ZrBhPntSuxfId_sAq4K0rXqsf2OJlGhHZhu81fKbh7WjZvDNU_cGAIW5h6CqF53JI1GlwNh_3lvKkbC16_q0A8T7vbuZPZmg9kVsmGM1z7FAdU4RzP4IfxjuA2nOBkN4HhP9CuTLu0bwmE1UzFgWGPTWxNjmBWJUq0zrYiLX4d-gcUvoprmZFqTD54LHHwiaahI__a6EV2H9vwAvnzMVJiuCw7L1lRIr3z6G1-pZbvKDliWMIKcVvQlhkHZ6kFVZtljZJTK28qIk2eRvh-zXC5EuKr7fMgQq2jdhUQeeChvsTDWliRgKMMJMZNLqQx3cAiNLfr8VeOo9X-VLq9IBXt61o4ipK4vNjl61WjO8_OiLV3mJCMkH313oWIl6AncBFd9gPLDgqoTG30kxmUgloEw_C0MWvFCDOVWzCPAan1HdclwugoXVA_i8crX2rNO970q_UCOIE-cxTM3osJ7laPVy2e9NC8r11i8OVnV9EtRQpCBHj19TbfIdvTGiumyQdmYmidOfQYXLzgFK4gxx2TMsSvdCY8RX9C9BqjzZkoKKr6KTQsJ4Ug3N7BKB7p4vGl3FFFBOOxfCpooAccNKGFzXvgXsofafz-aIvfKaArZtt_S6tnZJJKjAR_6y6TfN4ea3vw6xAEm3jpVSe3upDO2qjL5nsbIb4c-8PWLaaML4yXx8S4OXM8KePKRUBG6K8_5LUtXBFBcvcPRyedrp8HTl4yQ1JEN0x-7kQKltPX9osUZjs0CDHYUlvB2jRTJU4jB_GOyynGsgu-Qyc41EYxcCZicLEcX7FE0uQUKNPkwA2x71w0t1rc0uCLWLCsmVLpOjwLttKzroGVQBsK0IzpfknRSAIWhznSijAax5hxu-i-SkG1us1UoDjzicwE8yP6jG7kFR7Seoeu6eYwhKaWuz5EV_fc94HmbHIFxB0KsjN91QJcerrBYrvL7l-3er30b3jH2SqR8c4oq8qYPbuCrNxg_JlKIFNwV3mYGadcHCHaASstQpI3tDWIj3nc3z7YU_p6Y4SorqNhaPttBWOOjXE3Ymowx8sd_x_Tv3flYik21LuTd5VSq_BF45yL39-uV6XCgKGHLCXVfjz9u9L4XojssSVZQGYAf2LxgtTWemFmu-awOtXfxpJar60AGkGNNKv-xBIAGIMwKcvRsTkVb27-1ZVABr_3OBKUF9GaYc7WAO6yny9JaiLtQL2FNm0Ga2mZYMuCQI189prl-sm949afKb9ebjKUuAOpEeH_nsWxVDUy522dTOBw-MLQrFkzqh6dKm814ir7xMejkHYvv1RFfi93nRmlxGlMb64CCnisKBMwudgqOX5gv6ODAC0jXVsWcGwObh9vefVOU&cid=CAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 13:36:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73942
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Dec 2022 13:36:26 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame EDF0 41 KB
15 KB 29ms
26ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 23:12:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39387
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 25 Nov 2023 23:12:21 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame 489B 11 KB
4 KB 87ms
26ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCL7c1r-WBY-SxFaatmLAPiYa0uAGm5b2gaa2VnKfJD_AuEAEghveGJmCVAsgBCakC_V3iep9wsT6oAwGqBNsBT9CmQanN0ZVRBkH1HMuroP1twzoeRPHSeS2A3mmf48zG_J7cyujVmHQL1q7U4f815bdGj__0061SU0mwRfEprMXUVCR7t1tAvnqSX0pzF4MhHPnudl5NNxrYhIRyvE57HQYMUe1xSEZPsDXfnfd34PPdm_7hUxQgGf8LE8W13fzYQly8lp-27FpPuttTxzZBxzR-QuDy7o1kbj5sEUxcLhRoRxbRKmkNztg30CuF4ShL-5exTETalObyCbiS1f21CzmKoI887xLgWwwyIlG_GN8sI99dzZLqSbR0wATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBOPtdEO0BMA2BMD2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%26sig%3DAOD64_3CD0Bd2M95emgyO5c8M5_BbeddMw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A5ya0L6w4WyMK5jBUsy_FEBEHLGQPNT2rYddKdgAAQokp75SnNZyywzOeynkbzHeabARq4ZcuoJ-rOy1t4mMRlULvl7spNvkq2azQvnEvA70gNuhrDNir-IvooGJNrAczlXlvSxgidgAXItyrcCejGKdAq_wvd4klZhl4E48B2fc1EwG4%26cry%3D1%26dbm_d%3DAKAmf-DXsHS5vA6g3k5ALGouXZq81xNytZ7Ibqqs1Rw0kHNZXmh4eweeYABjZTQm5-Rj-1XyUCgXbnK8rovCwpilUA9Cmi5eZpmNLEWisP93gcPDeY6IjubGQsrF4l2NBLwn6AxFItRyvFIBm7gQFWV6d7NMxw7fJ7awp4K7Mp4XhhdFRHEQXn5vhr9Mz_4G7G7aQjykIy4L7kwcEbn4ShB6zOZoRi1FDpFER0F2KV2JDOc7LzP2XHX8xbUgFzw7P0lzC6AiK5b8Yv6OMjKnpKTwTs5XHVRd6dGRjfIzS8aNxTpULsP4qbqjlzgrDQCmAkQsZGAkFeNgNxFc27DPLvrKp3rucA3tpBGvBzN_g2BcSKoOFoZSsIPsdk9ZJSJhmqwMLpuXULlZTih0mOQM6q55egDZzotiZcOGdUKrtyNaWS13An9HxbojHCs_dNtIsc30sMKkd5fhkKFubrN3M1ea-e3m0ijayCht6RnMlAAJzbPejM8BB33_N9LWlaKTJQhepHbV-WFZDpruKY_MGHFdS1fgGFwTFk0PFkMwSdzOvCxdBkB9YPuzE1XE57h3jskKoqPV0gJu1NA5oaJaB8t_MmfVrC4G5A%26adurl%3D
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 98d2331dfaab8a314893f609d2923b04e920dbb03763b8dd1fd8c5c6bd6237b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Sat, 26 Nov 2022 10:08:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4079
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2398 22 KB
8 KB 23ms
22ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78297
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 25 Nov 2022 12:23:51 GMT
expires: Sat, 25 Nov 2023 12:23:51 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9C41 1 KB
643 B 23ms
22ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 65552
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 25 Nov 2022 15:56:16 GMT
etag: 48472445140208031
expires: Sat, 26 Nov 2022 15:56:16 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame EDF0 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 015c9cb380721b433b03963e459034a8b80d5fbfaefe5dcb16ee78c20af5ed8d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8BD5 22 KB
8 KB 25ms
23ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78297
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 25 Nov 2022 12:23:51 GMT
expires: Sat, 25 Nov 2023 12:23:51 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 4A1F 2 KB
1 KB 42ms
42ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y4HlrwAFWOMABhamAA0DCQMvuEgGAVrEUkQa2g&u=%7C7MxddUknimHH%2FClEdsK4cfw1RGB%2F%2FVaNDLwLJlNeAUA%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jvULOd3YfT8Kie5-AMuoqyTirKgE-lWZeo7Xkzl_-qONzvo5OuAh8Wye-WwROab7zsr3F-aRieyN3GBFyOnMAAO13pvh_PMvVGi46znF51M1la_GFccwBFquMloJY6zQEkFfovP9gvOndJjmX_pNlCStJYjDmXQ8VHaUeQS_-mSV30KKVfo94iHUE4b-PaFhYvnPOZWYQWqa28DlFdAeBeCab5R5QUwmyognhmkIOMrjOGrXtx3x8qKkqe6BeGX15O2A-hnP2EUDgdUfs-ztbsVRQEpfkMUGm48bC-9pyA4XCm1WxLDhJW9Cw-5zJGaaCLgHRYdVaLlHUt3P63-7ff6HTFQ1lmZvnU6CPsnVbtjQjnOkPx0UkJxwHgEs4WCkCaTR1AvInCMGnA0FqWRCO3scCz6eHR1kuTfZvJaZUdq_s9T3dP5oK94RxLrgt9uJBWYID8145pgbMnm6qQ-xCrYCEQH4zQTqBIINQHsE6pRCO5638OUbuWX-COdnr5fkYEjEQtz5f4vRIMifSn0y-py7BVFF9r7FvoRu-mxS4kyFpsY4oPICmOutfWybLI28thPE5ZcIG6UVa6MER-99RMI&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCiM2Xr-WBY-OxFaatmLAPiYa0uAHJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItMTA2Mjk3Mjg2MTU1MzMwM8gBCakC_V3iep9wsT7gAgCoAwGqBPkBT9AUSF5Gg1rgr7CG5QuIQbbAuQzsn1VgpSYEBDJ1XK0-AIJo7Y0miUm1n3p2f_t1Cqo4A-AyQzu6TmCAoIi_m1KS5dHPBPbzk3NogZpBAEUehhJIjKrrCNUzKG76rnuSMfyvJxgxE7t52oA9U9mtOHvY6V5LgtMDHT_dLTY_d1UIjfhJJfg8c5lGaT9cz58cpJEJs9DKGZuzm5Vkzz7zrxEprxzNgofdYK1-YGB2icTk-MF-MSksB7RFdBVYHNBoZ10jtXA3wZS9VyVBLpILa6HqeV-8YZWu00lVE1U8U3HNPDBnt0NldzbXEDSKCJOJO7eI6jGgQ0184AQBgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0cG0KpuOH1dVx5WPeu5SDK1uaRkw%26client%3Dca-pub-1062972861553303%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 21 Nov 2023 10:08:48 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 4A1F 2 KB
1 KB 45ms
45ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 21 Nov 2023 10:08:48 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 4A1F 308 B
636 B 59ms
58ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Tue, 21 Nov 2023 10:08:48 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 4A1F 293 B
621 B 42ms
41ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Tue, 21 Nov 2023 10:08:48 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 4A1F 43 B
348 B 104ms
34ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=eLisanyB9hrfaY7YMBZvZt17b_FvugY8azvrtY_BT9cvzxAN6KVqxYRWJy81g8j9NbX3dLhWeebnEZR64h_A_parYWVlpyBYnz2nJ2BY05uiWM4VwPq9RR1W1TRPTQGlJbTdiq3mlt3NDgQ5GMTnheQiCbCtoIAkPMHo5mP0a7fg-llVSs11Sp9Rrd1eJ74X1vAeUejI2UP1QQ4xM6-0xKDrEhUXhvDLyRkw8s0b-oCyOSMDN9IpiYVKTor05qRReETIHqn3qnUeobrhGOU5mtfNsKPbxuwQnnMzIEbv_iIh-pBcRnjdTSx7CKIbYZa_Y-77-4CuXI6NHfWGPK7qg6cjDVvG3Knl_PeNHI7o4vI5YhH2fevrB5DTIxU4zm9_VuHHEPslqxLG-UOKYF-a9hs_mHkk2RsPBrmUcZSXusGlxgMy

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 4601470
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame 4A1F 44 B
752 B 195ms
115ms Image
image/gif 2600:9000:223c:5000:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1669457327
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y4HlrwAFWOMABhamAA0DCQMvuEgGAVrEUkQa2g&u=%7C7MxddUknimHH%2FClEdsK4cfw1RGB%2F%2FVaNDLwLJlNeAUA%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jvULOd3YfT8Kie5-AMuoqyTirKgE-lWZeo7Xkzl_-qONzvo5OuAh8Wye-WwROab7zsr3F-aRieyN3GBFyOnMAAO13pvh_PMvVGi46znF51M1la_GFccwBFquMloJY6zQEkFfovP9gvOndJjmX_pNlCStJYjDmXQ8VHaUeQS_-mSV30KKVfo94iHUE4b-PaFhYvnPOZWYQWqa28DlFdAeBeCab5R5QUwmyognhmkIOMrjOGrXtx3x8qKkqe6BeGX15O2A-hnP2EUDgdUfs-ztbsVRQEpfkMUGm48bC-9pyA4XCm1WxLDhJW9Cw-5zJGaaCLgHRYdVaLlHUt3P63-7ff6HTFQ1lmZvnU6CPsnVbtjQjnOkPx0UkJxwHgEs4WCkCaTR1AvInCMGnA0FqWRCO3scCz6eHR1kuTfZvJaZUdq_s9T3dP5oK94RxLrgt9uJBWYID8145pgbMnm6qQ-xCrYCEQH4zQTqBIINQHsE6pRCO5638OUbuWX-COdnr5fkYEjEQtz5f4vRIMifSn0y-py7BVFF9r7FvoRu-mxS4kyFpsY4oPICmOutfWybLI28thPE5ZcIG6UVa6MER-99RMI&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCiM2Xr-WBY-OxFaatmLAPiYa0uAHJntKxXNWdkfdwwI23ARABIABglQKCARdjYS1wdWItMTA2Mjk3Mjg2MTU1MzMwM8gBCakC_V3iep9wsT7gAgCoAwGqBPkBT9AUSF5Gg1rgr7CG5QuIQbbAuQzsn1VgpSYEBDJ1XK0-AIJo7Y0miUm1n3p2f_t1Cqo4A-AyQzu6TmCAoIi_m1KS5dHPBPbzk3NogZpBAEUehhJIjKrrCNUzKG76rnuSMfyvJxgxE7t52oA9U9mtOHvY6V5LgtMDHT_dLTY_d1UIjfhJJfg8c5lGaT9cz58cpJEJs9DKGZuzm5Vkzz7zrxEprxzNgofdYK1-YGB2icTk-MF-MSksB7RFdBVYHNBoZ10jtXA3wZS9VyVBLpILa6HqeV-8YZWu00lVE1U8U3HNPDBnt0NldzbXEDSKCJOJO7eI6jGgQ0184AQBgAbHzc-Y357tqfkBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0cG0KpuOH1dVx5WPeu5SDK1uaRkw%26client%3Dca-pub-1062972861553303%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:5000:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
via: 1.1 018ffb575888f1c9ec960e3e977c042e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
cross-origin-resource-policy: cross-origin
content-length: 44
pragma: no-cache
server: nginx
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-methods: POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
x-amz-cf-id: d2yXksNTqjLgp0tejM9-mCoV_ArXczpCMP7fhEsWbgk1W4V7x-fb6g==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 200 r62eglto.js
ad4m.at/ Frame EDF0 35 KB
12 KB 73ms
46ms Other
application/javascript 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9624c9f30634be84a224d007e5df178a51107bff3e456e2a90b504cbf350d190

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 22 Nov 2022 06:17:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 359432
etag: W/"49e3b0ffd5e74f27b691e89cf271d672"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tl%2BSb3AzrUJxmVLclL%2BYppFznGlV5P83tgSiErou6ShZi76CSn0icoaU8SjoMmnEI7gro6hj4jjRGz0yt%2BHOU9thEAuWb9zhnxz%2Fz9BCNEgdbEmcHkselym%2BbaViPPgL4GQWv%2F8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
cf-ray: 7701d32f382c8fe9-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Tue, 22 Nov 2022 06:18:06 GMT

GET
H/1.1

200
OK

request.php Show response
hal900012.redintelligence.net/ Frame 489B
Redirect Chain

https://hal900012.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=518a00a719&subid=&uid=632d4ac738f85877&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900012.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=518a00a719&subid=&uid=632d4ac738f85877&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

140ms
89ms

Script
application/x-javascript

94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900012.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=518a00a719&subid=&uid=632d4ac738f85877&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCL7c1r-WBY-SxFaatmLAPiYa0uAGm5b2gaa2VnKfJD_AuEAEghveGJmCVAsgBCakC_V3iep9wsT6oAwGqBNsBT9CmQanN0ZVRBkH1HMuroP1twzoeRPHSeS2A3mmf48zG_J7cyujVmHQL1q7U4f815bdGj__0061SU0mwRfEprMXUVCR7t1tAvnqSX0pzF4MhHPnudl5NNxrYhIRyvE57HQYMUe1xSEZPsDXfnfd34PPdm_7hUxQgGf8LE8W13fzYQly8lp-27FpPuttTxzZBxzR-QuDy7o1kbj5sEUxcLhRoRxbRKmkNztg30CuF4ShL-5exTETalObyCbiS1f21CzmKoI887xLgWwwyIlG_GN8sI99dzZLqSbR0wATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBOPtdEO0BMA2BMD2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%26sig%3DAOD64_3CD0Bd2M95emgyO5c8M5_BbeddMw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A5ya0L6w4WyMK5jBUsy_FEBEHLGQPNT2rYddKdgAAQokp75SnNZyywzOeynkbzHeabARq4ZcuoJ-rOy1t4mMRlULvl7spNvkq2azQvnEvA70gNuhrDNir-IvooGJNrAczlXlvSxgidgAXItyrcCejGKdAq_wvd4klZhl4E48B2fc1EwG4%26cry%3D1%26dbm_d%3DAKAmf-DXsHS5vA6g3k5ALGouXZq81xNytZ7Ibqqs1Rw0kHNZXmh4eweeYABjZTQm5-Rj-1XyUCgXbnK8rovCwpilUA9Cmi5eZpmNLEWisP93gcPDeY6IjubGQsrF4l2NBLwn6AxFItRyvFIBm7gQFWV6d7NMxw7fJ7awp4K7Mp4XhhdFRHEQXn5vhr9Mz_4G7G7aQjykIy4L7kwcEbn4ShB6zOZoRi1FDpFER0F2KV2JDOc7LzP2XHX8xbUgFzw7P0lzC6AiK5b8Yv6OMjKnpKTwTs5XHVRd6dGRjfIzS8aNxTpULsP4qbqjlzgrDQCmAkQsZGAkFeNgNxFc27DPLvrKp3rucA3tpBGvBzN_g2BcSKoOFoZSsIPsdk9ZJSJhmqwMLpuXULlZTih0mOQM6q55egDZzotiZcOGdUKrtyNaWS13An9HxbojHCs_dNtIsc30sMKkd5fhkKFubrN3M1ea-e3m0ijayCht6RnMlAAJzbPejM8BB33_N9LWlaKTJQhepHbV-WFZDpruKY_MGHFdS1fgGFwTFk0PFkMwSdzOvCxdBkB9YPuzE1XE57h3jskKoqPV0gJu1NA5oaJaB8t_MmfVrC4G5A%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=731906981908&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 353fc90e05c9b1d54690df1d90315bccd9d88b33c3b7380be73c935f2872c642

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 26 Nov 2022 10:08:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 74213800036373104444554012155012
Connection: close
Content-Length: 1307
Expires: Sat, 26 Nov 2022 10:08:48 +0100

Redirect headers

Pragma: no-cache
Date: Sat, 26 Nov 2022 10:08:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=518a00a719&subid=&uid=632d4ac738f85877&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCL7c1r-WBY-SxFaatmLAPiYa0uAGm5b2gaa2VnKfJD_AuEAEghveGJmCVAsgBCakC_V3iep9wsT6oAwGqBNsBT9CmQanN0ZVRBkH1HMuroP1twzoeRPHSeS2A3mmf48zG_J7cyujVmHQL1q7U4f815bdGj__0061SU0mwRfEprMXUVCR7t1tAvnqSX0pzF4MhHPnudl5NNxrYhIRyvE57HQYMUe1xSEZPsDXfnfd34PPdm_7hUxQgGf8LE8W13fzYQly8lp-27FpPuttTxzZBxzR-QuDy7o1kbj5sEUxcLhRoRxbRKmkNztg30CuF4ShL-5exTETalObyCbiS1f21CzmKoI887xLgWwwyIlG_GN8sI99dzZLqSbR0wATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBOPtdEO0BMA2BMD2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%26sig%3DAOD64_3CD0Bd2M95emgyO5c8M5_BbeddMw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A5ya0L6w4WyMK5jBUsy_FEBEHLGQPNT2rYddKdgAAQokp75SnNZyywzOeynkbzHeabARq4ZcuoJ-rOy1t4mMRlULvl7spNvkq2azQvnEvA70gNuhrDNir-IvooGJNrAczlXlvSxgidgAXItyrcCejGKdAq_wvd4klZhl4E48B2fc1EwG4%26cry%3D1%26dbm_d%3DAKAmf-DXsHS5vA6g3k5ALGouXZq81xNytZ7Ibqqs1Rw0kHNZXmh4eweeYABjZTQm5-Rj-1XyUCgXbnK8rovCwpilUA9Cmi5eZpmNLEWisP93gcPDeY6IjubGQsrF4l2NBLwn6AxFItRyvFIBm7gQFWV6d7NMxw7fJ7awp4K7Mp4XhhdFRHEQXn5vhr9Mz_4G7G7aQjykIy4L7kwcEbn4ShB6zOZoRi1FDpFER0F2KV2JDOc7LzP2XHX8xbUgFzw7P0lzC6AiK5b8Yv6OMjKnpKTwTs5XHVRd6dGRjfIzS8aNxTpULsP4qbqjlzgrDQCmAkQsZGAkFeNgNxFc27DPLvrKp3rucA3tpBGvBzN_g2BcSKoOFoZSsIPsdk9ZJSJhmqwMLpuXULlZTih0mOQM6q55egDZzotiZcOGdUKrtyNaWS13An9HxbojHCs_dNtIsc30sMKkd5fhkKFubrN3M1ea-e3m0ijayCht6RnMlAAJzbPejM8BB33_N9LWlaKTJQhepHbV-WFZDpruKY_MGHFdS1fgGFwTFk0PFkMwSdzOvCxdBkB9YPuzE1XE57h3jskKoqPV0gJu1NA5oaJaB8t_MmfVrC4G5A%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=731906981908&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Sat, 26 Nov 2022 10:08:48 +0100

GET
H3 200 frame.html Show response
ad4m.at/ Frame 1BA5 2 KB
1 KB 43ms
43ms Document
text/html 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d485f783c7cc440cba21bb750ce67e191bce0783bfc6cff5f98e236e401b7ab

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2642615
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=3600
cf-cache-status: HIT
cf-ray: 7701d32f383a8fe9-FRA
content-encoding: br
content-language: en
content-type: text/html; charset=utf-8
date: Sat, 26 Nov 2022 10:08:48 GMT
expires: Wed, 26 Oct 2022 21:05:13 GMT
last-modified: Thu, 25 Aug 2022 14:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7GbA316HYBVyDmFt7Pgi3jk%2B0azcwNzf93UF0JBDSzTm6AL9ycpYrlOQto2Mh1YKV6%2FCUa1dHI5roCeWmfmHVjaWOIKQ1hErr1LgbuOqH2sqpzBmXvPFdKDrUZzyoVsXozQUXws%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 4A1F 12 KB
6 KB 42ms
42ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 21 Nov 2023 10:08:48 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4A1F 14 KB
14 KB 162ms
76ms Image
image/png 2a02:2638:1::8
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=92&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F8d6bc06124f044d4973e0db21c495799_logo.png&v=3&w=668&s=RzlXPgLWe7UusCNVxlt4lCp9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

b94a89259ef175b881195823edba0134e626911f4dc3baaac1bece619eff6bb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:47 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28584986
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13859
expires: Mon, 23 Oct 2023 06:25:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4A1F 2 KB
2 KB 163ms
77ms Image
image/webp 2a02:2638:1::8
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FD%2FlogoAmazon-Workforce-Staffing-245849DE-2005201401.gif%3Feb%3D1&v=3&w=400&s=S8H46qf3EvuvyZds2gfujwsz&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

d530eb650281c426cb8d0c8d602cffe1a63b732b9b4d93e33aaf0340896e3024

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=900367
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1902
expires: Tue, 06 Dec 2022 20:14:56 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4A1F 2 KB
2 KB 162ms
76ms Image
image/webp 2a02:2638:1::8
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F4%2FlogoKETTLER-Alu-Rad-GmbH-214588DE.gif%3Feb%3D1&v=3&w=400&s=n2tNaohBIvoGDd_w4AS9zSPs&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::8 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

09f98d97f74df9d75aa4363f3e58c2ef785012af2de874db3fee91e364605d7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:47 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2416306
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2222
expires: Sat, 24 Dec 2022 09:20:35 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 4A1F 0
128 B 144ms
42ms Ping
text/plain 2a02:2638:1::17
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=3nV-DsdzwNOoML8htW_skJBHuNDMNzJVhLAkrkPUTgSBRTQ51_c6GdPhpDUgCLBiE6siPp_D7Oji1YH4TCnDS3C28Qm8B4k4gf6apv4M8G2ju1DaKYHLy6UOz8dIch24--w095LSSuSFIcxhKwzduvxd97Q6TfjAu9fB5Kwd5TNnu54MDW7koW0HT_vTtJiwUH2wLlbG0uXapUH9vCqtnQI3Ts_PBQayH2GEQmpivpbSFixzMpARXHYS8mgt1K82Q1aeRA&sds=2&rev=83599&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 4A1F 2 KB
1 KB 42ms
41ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 21 Nov 2023 10:08:48 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 4A1F 2 KB
1 KB 45ms
45ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 21 Nov 2023 10:08:48 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 9C41 35 B
210 B 28ms
24ms Image
image/gif 2620:116:800d:21:93ca:31d8:d86e:38f6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJds_r20Pmfggd9yQVTOSFM&google_cver=1&google_push=ASkJ3FZO1UwYeugU43HXuRhdZp307RRZF1OeI843oFF7LBoIA3Wb5583gIXCqU47V0xlG7oGCAnW4QtqvF8Dx8BzNLDgNclR4PUr

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:93ca:31d8:d86e:38f6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 9C41 70 B
264 B 53ms
48ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESENS_hMtqG5TDKxgrm7HHSxc&google_cver=1&google_push=ASkJ3FYaDEyA9wbvsq99pvBfBb84KnzvmbY_UvfHZC_4-fyPw1N-xNncN0MRwFipwzEmtwGqvhnJo_uWh_khP3XPlWWDtCODDDOb
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C41
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESENKHtsUauHnIDjr8AyWkx6E&google_cver=1&google_push=ASkJ3FYwQNo3FjSPdNo4QWdbqzCA8WyzomGeKBgU1oNA6ok_uCunHff00uZMhgASC8kl4x-uT9xrQrpXXHZ...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ASkJ3FYwQNo3FjSPdNo4QWdbqzCA8WyzomGeKBgU1oNA6ok_uCunHff00uZMhgASC8kl4x-uT9xrQrpXXHZ2m7dV-IQc_CF-HmWY&google_hm=azNidpyTTo6eOh80tMhVgoU

170 B
188 B

37ms
37ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ASkJ3FYwQNo3FjSPdNo4QWdbqzCA8WyzomGeKBgU1oNA6ok_uCunHff00uZMhgASC8kl4x-uT9xrQrpXXHZ2m7dV-IQc_CF-HmWY&google_hm=azNidpyTTo6eOh80tMhVgoU

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ASkJ3FYwQNo3FjSPdNo4QWdbqzCA8WyzomGeKBgU1oNA6ok_uCunHff00uZMhgASC8kl4x-uT9xrQrpXXHZ2m7dV-IQc_CF-HmWY&google_hm=azNidpyTTo6eOh80tMhVgoU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C41
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEK4M7HM9Tm0Q4EqpmOL0IR0&google_cver=1&google_push=ASkJ3FYXvCyvkIxyzdm6X09y8bQjFY2o41jZHVKQRqEVV92O4e5YFp8ux0WBbj5Pf4F9knQiXwnEbinxQfyHdu...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MDI2NDYyNTgzNzcwMTI2OA%3D%3D&google_push=ASkJ3FYXvCyvkIxyzdm6X09y8bQjFY2o41jZHVKQRqEVV92O4e5YFp8ux0WBbj5Pf4F9knQiXwnEbinxQfyHdutPZK...

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MDI2NDYyNTgzNzcwMTI2OA%3D%3D&google_push=ASkJ3FYXvCyvkIxyzdm6X09y8bQjFY2o41jZHVKQRqEVV92O4e5YFp8ux0WBbj5Pf4F9knQiXwnEbinxQfyHdutPZKqpOVYqn6E

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MDI2NDYyNTgzNzcwMTI2OA%3D%3D&google_push=ASkJ3FYXvCyvkIxyzdm6X09y8bQjFY2o41jZHVKQRqEVV92O4e5YFp8ux0WBbj5Pf4F9knQiXwnEbinxQfyHdutPZKqpOVYqn6E
Date: Sat, 26 Nov 2022 10:08:48 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3 200 dds
rtb.openx.net/sync/ Frame 9C41 43 B
64 B 56ms
31ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESED7kFfZ5KgDQuM2Jri4NTGI&google_cver=1&google_push=ASkJ3FbYWFZU5JtANPhQRABOw0kVH025Vvp1dRs5EcpyoxuTYK2bJB3LmRFFUIFOTAy1Qx1hvMFcoZynW6SnuvqjkfJhC5yY1CD5
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: g2ht2qsh7fqnmslvlapnoe1lsj8pk0sr

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C41
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFoqUBLFeQr1M1jSmENL6V0&google_cver=1&google_push=ASkJ3FYYhNLFyxLIZrgT6i-0cuxadGvrEXwK73M15Q_fwIGZF8voT4JP1esZNBLoL6i-cFCLqLC...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFYUlNFWjQtUi1HMUxQ&google_push=ASkJ3FYYhNLFyxLIZrgT6i-0cuxadGvrEXwK73M15Q_fwIGZF8voT4JP1esZNBLoL6i-cFCLqLC2hEgbNja0lqLZ08NV-fpp-8A

170 B
188 B

36ms
36ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFYUlNFWjQtUi1HMUxQ&google_push=ASkJ3FYYhNLFyxLIZrgT6i-0cuxadGvrEXwK73M15Q_fwIGZF8voT4JP1esZNBLoL6i-cFCLqLC2hEgbNja0lqLZ08NV-fpp-8A

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFYUlNFWjQtUi1HMUxQ&google_push=ASkJ3FYYhNLFyxLIZrgT6i-0cuxadGvrEXwK73M15Q_fwIGZF8voT4JP1esZNBLoL6i-cFCLqLC2hEgbNja0lqLZ08NV-fpp-8A
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C41
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_hm=Y4HlsJm95hzW-femBIQXPgAADSkAAAIB&google_nid=index&google_push=ASkJ3FarOnMHtrxVMmKk_17UpKPJpQR6s8mWb...

170 B
188 B

37ms
37ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_hm=Y4HlsJm95hzW-femBIQXPgAADSkAAAIB&google_nid=index&google_push=ASkJ3FarOnMHtrxVMmKk_17UpKPJpQR6s8mWb7PwFVJ39INnkTjmCk3GJpCCwXNGShCh2-mbXQkwb8dopQ56pWAQNg5_PerjTnuN

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EfrMpqsyJ2w4ICdszjPPVvwN07InjgZYdB9HyUS3ESWltaZ7fDcJWelyde4EVQ%2BdAj5lC4K8cEqMBekNsEHMgV0ffEcZTVpkzauh9tsR0E0VOliFO%2BNGov98X5R6U46GU8vugMm3Z1vHQg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_hm=Y4HlsJm95hzW-femBIQXPgAADSkAAAIB&google_nid=index&google_push=ASkJ3FarOnMHtrxVMmKk_17UpKPJpQR6s8mWb7PwFVJ39INnkTjmCk3GJpCCwXNGShCh2-mbXQkwb8dopQ56pWAQNg5_PerjTnuN
cache-control: no-cache
cf-ray: 7701d32fba039945-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9C41 0
12 B 37ms
33ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JIh4FAZxi8-rPPTLlP4aejxZXp1fos4B6aONoMT8WLz-N0V4InC_RpIvohcd7fnObmlCPe

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js Show response
pagead2.googlesyndication.com/bg/ Frame 2398 36 KB
16 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 21:21:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132446
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15969
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 24 Nov 2023 21:21:22 GMT

GET
H3 200 Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js Show response
pagead2.googlesyndication.com/bg/ Frame 8BD5 36 KB
16 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 21:21:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132446
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15969
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 24 Nov 2023 21:21:22 GMT

POST
H3 200 rs Show response
ad4m.at/ Frame EDF0 2 KB
2 KB 83ms
80ms XHR
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9019994d6db848fc3088f7434f44d1cb8f6766e120bcbbf6d2d1e1399a347b0d

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GSRe0uXFHa%2BjlVaNu1s0Sw97wbziSEiD52VTCnNvs%2BK2IRd7jWAsR5Y3sfUbbHH38s1mXYdFLE%2B0ogSWo7jaMx9a6Qr9EiRM%2ByAkm9%2F9l3YkAXKG%2Fr3%2FH6rmdmWKQYouuUervu8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
access-control-allow-credentials: true
cf-ray: 7701d3307c819c06-FRA
x-backend-server: aa-reachservice-group-europe-west1-ktgt
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 96ms
69ms Preflight
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-origin: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
access-control-max-age: 1800
allow: HEAD,POST,GET,OPTIONS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7701d3300b619c06-FRA
content-length: 24
content-type: text/plain
date: Sat, 26 Nov 2022 10:08:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kGHYw6scAJGDdTMQGsZ8W%2FlZ21sab2tl0ByyEyqlyJlzFxd9aCGVRsCBmdnla1hhzHSU8Ln0jB0QOm2X3vIUgVXFuPjyh2BHxDNUcMv5QPu4TbRVlMKPyhDq%2BgXuZnFrbMW4INg%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
via: 1.1 google
x-backend-server: aa-reachservice-group-europe-west1-ktgt

GET
H2 200 / Show response
adv.office-partner.de/ Frame 7A3C 930 B
931 B 85ms
22ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=518a00a719&subid=&uid=632d4ac738f85877&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCL7c1r-WBY-SxFaatmLAPiYa0uAGm5b2gaa2VnKfJD_AuEAEghveGJmCVAsgBCakC_V3iep9wsT6oAwGqBNsBT9CmQanN0ZVRBkH1HMuroP1twzoeRPHSeS2A3mmf48zG_J7cyujVmHQL1q7U4f815bdGj__0061SU0mwRfEprMXUVCR7t1tAvnqSX0pzF4MhHPnudl5NNxrYhIRyvE57HQYMUe1xSEZPsDXfnfd34PPdm_7hUxQgGf8LE8W13fzYQly8lp-27FpPuttTxzZBxzR-QuDy7o1kbj5sEUxcLhRoRxbRKmkNztg30CuF4ShL-5exTETalObyCbiS1f21CzmKoI887xLgWwwyIlG_GN8sI99dzZLqSbR0wATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBOPtdEO0BMA2BMD2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%26sig%3DAOD64_3CD0Bd2M95emgyO5c8M5_BbeddMw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A5ya0L6w4WyMK5jBUsy_FEBEHLGQPNT2rYddKdgAAQokp75SnNZyywzOeynkbzHeabARq4ZcuoJ-rOy1t4mMRlULvl7spNvkq2azQvnEvA70gNuhrDNir-IvooGJNrAczlXlvSxgidgAXItyrcCejGKdAq_wvd4klZhl4E48B2fc1EwG4%26cry%3D1%26dbm_d%3DAKAmf-DXsHS5vA6g3k5ALGouXZq81xNytZ7Ibqqs1Rw0kHNZXmh4eweeYABjZTQm5-Rj-1XyUCgXbnK8rovCwpilUA9Cmi5eZpmNLEWisP93gcPDeY6IjubGQsrF4l2NBLwn6AxFItRyvFIBm7gQFWV6d7NMxw7fJ7awp4K7Mp4XhhdFRHEQXn5vhr9Mz_4G7G7aQjykIy4L7kwcEbn4ShB6zOZoRi1FDpFER0F2KV2JDOc7LzP2XHX8xbUgFzw7P0lzC6AiK5b8Yv6OMjKnpKTwTs5XHVRd6dGRjfIzS8aNxTpULsP4qbqjlzgrDQCmAkQsZGAkFeNgNxFc27DPLvrKp3rucA3tpBGvBzN_g2BcSKoOFoZSsIPsdk9ZJSJhmqwMLpuXULlZTih0mOQM6q55egDZzotiZcOGdUKrtyNaWS13An9HxbojHCs_dNtIsc30sMKkd5fhkKFubrN3M1ea-e3m0ijayCht6RnMlAAJzbPejM8BB33_N9LWlaKTJQhepHbV-WFZDpruKY_MGHFdS1fgGFwTFk0PFkMwSdzOvCxdBkB9YPuzE1XE57h3jskKoqPV0gJu1NA5oaJaB8t_MmfVrC4G5A%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=731906981908&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Sat, 26 Nov 2022 10:08:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Sat, 03 Dec 2022 10:08:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame A927
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=74213800036373104444554012155012&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=74213800036373104444554012155012&actionid=981741&produktid=&dt_url=

0
607 B

117ms
54ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=74213800036373104444554012155012&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=518a00a719&subid=&uid=632d4ac738f85877&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCL7c1r-WBY-SxFaatmLAPiYa0uAGm5b2gaa2VnKfJD_AuEAEghveGJmCVAsgBCakC_V3iep9wsT6oAwGqBNsBT9CmQanN0ZVRBkH1HMuroP1twzoeRPHSeS2A3mmf48zG_J7cyujVmHQL1q7U4f815bdGj__0061SU0mwRfEprMXUVCR7t1tAvnqSX0pzF4MhHPnudl5NNxrYhIRyvE57HQYMUe1xSEZPsDXfnfd34PPdm_7hUxQgGf8LE8W13fzYQly8lp-27FpPuttTxzZBxzR-QuDy7o1kbj5sEUxcLhRoRxbRKmkNztg30CuF4ShL-5exTETalObyCbiS1f21CzmKoI887xLgWwwyIlG_GN8sI99dzZLqSbR0wATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBOPtdEO0BMA2BMD2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%26sig%3DAOD64_3CD0Bd2M95emgyO5c8M5_BbeddMw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A5ya0L6w4WyMK5jBUsy_FEBEHLGQPNT2rYddKdgAAQokp75SnNZyywzOeynkbzHeabARq4ZcuoJ-rOy1t4mMRlULvl7spNvkq2azQvnEvA70gNuhrDNir-IvooGJNrAczlXlvSxgidgAXItyrcCejGKdAq_wvd4klZhl4E48B2fc1EwG4%26cry%3D1%26dbm_d%3DAKAmf-DXsHS5vA6g3k5ALGouXZq81xNytZ7Ibqqs1Rw0kHNZXmh4eweeYABjZTQm5-Rj-1XyUCgXbnK8rovCwpilUA9Cmi5eZpmNLEWisP93gcPDeY6IjubGQsrF4l2NBLwn6AxFItRyvFIBm7gQFWV6d7NMxw7fJ7awp4K7Mp4XhhdFRHEQXn5vhr9Mz_4G7G7aQjykIy4L7kwcEbn4ShB6zOZoRi1FDpFER0F2KV2JDOc7LzP2XHX8xbUgFzw7P0lzC6AiK5b8Yv6OMjKnpKTwTs5XHVRd6dGRjfIzS8aNxTpULsP4qbqjlzgrDQCmAkQsZGAkFeNgNxFc27DPLvrKp3rucA3tpBGvBzN_g2BcSKoOFoZSsIPsdk9ZJSJhmqwMLpuXULlZTih0mOQM6q55egDZzotiZcOGdUKrtyNaWS13An9HxbojHCs_dNtIsc30sMKkd5fhkKFubrN3M1ea-e3m0ijayCht6RnMlAAJzbPejM8BB33_N9LWlaKTJQhepHbV-WFZDpruKY_MGHFdS1fgGFwTFk0PFkMwSdzOvCxdBkB9YPuzE1XE57h3jskKoqPV0gJu1NA5oaJaB8t_MmfVrC4G5A%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=731906981908&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 26 Nov 2022 10:08:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Sat, 26 Nov 2022 11:08:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Sat, 26 Nov 2022 10:08:48 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=74213800036373104444554012155012&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D785:B2E0_91EFC182:01BB_6381E5B0_C816BDE:491D

GET
H2 200 link.html Show response
track.webgains.com/ Frame 489B 2 KB
2 KB 220ms
132ms Script
text/html 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=74213800036373104444554012155012&nw=1
Requested by: Host: www.timotolkki.net
URL: http://www.timotolkki.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: dd8d2e0ebb43bfb47b97b3c5b4c9766d71924edb7d58ea7e9e75c77a160d31ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
last-modified: Sat, 26 Nov 2022 10:08:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sat, 26 Nov 2022 10:09:48 GMT

GET
H3

200

activityi;dc_pre=CNO_t5jNy_sCFQjMmgod8QAJLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5155768703976.837 Show response
8019191.fls.doubleclick.net/ Frame 3F88
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5155768703976.837?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CNO_t5jNy_sCFQjMmgod8QAJLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5155768703976.837?

391 B
241 B

115ms
70ms

Document
text/html

142.250.185.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CNO_t5jNy_sCFQjMmgod8QAJLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5155768703976.837?

Requested by

Host: www.timotolkki.net
URL: http://www.timotolkki.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f6.1e100.net

Software

cafe /

Resource Hash

16936ea800c97aa6837ebbd5406f235d099b0ccc30db8f3bf67d6e58f93633f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:48 GMT
expires: Sat, 26 Nov 2022 10:08:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CNO_t5jNy_sCFQjMmgod8QAJLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5155768703976.837?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900012.redintelligence.net/ Frame 3878 7 KB
2 KB 76ms
26ms Document
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900012.redintelligence.net/request_content.php?s=74213800036373104444554012155012&a=b9b9865b
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=518a00a719&subid=&uid=632d4ac738f85877&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCL7c1r-WBY-SxFaatmLAPiYa0uAGm5b2gaa2VnKfJD_AuEAEghveGJmCVAsgBCakC_V3iep9wsT6oAwGqBNsBT9CmQanN0ZVRBkH1HMuroP1twzoeRPHSeS2A3mmf48zG_J7cyujVmHQL1q7U4f815bdGj__0061SU0mwRfEprMXUVCR7t1tAvnqSX0pzF4MhHPnudl5NNxrYhIRyvE57HQYMUe1xSEZPsDXfnfd34PPdm_7hUxQgGf8LE8W13fzYQly8lp-27FpPuttTxzZBxzR-QuDy7o1kbj5sEUxcLhRoRxbRKmkNztg30CuF4ShL-5exTETalObyCbiS1f21CzmKoI887xLgWwwyIlG_GN8sI99dzZLqSbR0wATrj_yO9wPgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBOPtdEO0BMA2BMD2BQB0BUB-BYBgBcB%26num%3D1%26cid%3DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%26sig%3DAOD64_3CD0Bd2M95emgyO5c8M5_BbeddMw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A5ya0L6w4WyMK5jBUsy_FEBEHLGQPNT2rYddKdgAAQokp75SnNZyywzOeynkbzHeabARq4ZcuoJ-rOy1t4mMRlULvl7spNvkq2azQvnEvA70gNuhrDNir-IvooGJNrAczlXlvSxgidgAXItyrcCejGKdAq_wvd4klZhl4E48B2fc1EwG4%26cry%3D1%26dbm_d%3DAKAmf-DXsHS5vA6g3k5ALGouXZq81xNytZ7Ibqqs1Rw0kHNZXmh4eweeYABjZTQm5-Rj-1XyUCgXbnK8rovCwpilUA9Cmi5eZpmNLEWisP93gcPDeY6IjubGQsrF4l2NBLwn6AxFItRyvFIBm7gQFWV6d7NMxw7fJ7awp4K7Mp4XhhdFRHEQXn5vhr9Mz_4G7G7aQjykIy4L7kwcEbn4ShB6zOZoRi1FDpFER0F2KV2JDOc7LzP2XHX8xbUgFzw7P0lzC6AiK5b8Yv6OMjKnpKTwTs5XHVRd6dGRjfIzS8aNxTpULsP4qbqjlzgrDQCmAkQsZGAkFeNgNxFc27DPLvrKp3rucA3tpBGvBzN_g2BcSKoOFoZSsIPsdk9ZJSJhmqwMLpuXULlZTih0mOQM6q55egDZzotiZcOGdUKrtyNaWS13An9HxbojHCs_dNtIsc30sMKkd5fhkKFubrN3M1ea-e3m0ijayCht6RnMlAAJzbPejM8BB33_N9LWlaKTJQhepHbV-WFZDpruKY_MGHFdS1fgGFwTFk0PFkMwSdzOvCxdBkB9YPuzE1XE57h3jskKoqPV0gJu1NA5oaJaB8t_MmfVrC4G5A%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=731906981908&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: f7f75abc0f99cadb6f503b69f8569cca020d62a619f4fb4d3bdd9074a2433f47

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2023
Content-Type: text/html; charset=utf-8
Date: Sat, 26 Nov 2022 10:08:48 GMT
Expires: Sat, 26 Nov 2022 10:08:48 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 489B
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=74213800036373104444554012155012
https://ad-server.eu/wm/pb/native.png

68 B
312 B

225ms
43ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Sat, 26 Nov 2022 10:12:15 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Sat, 26 Nov 2022 10:08:48 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: D972D785:B2DE_91EFC182:01BB_6381E5B0_C8241C0:491C
X-IPLB-Instance: 40027
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 489B 43 B
702 B 117ms
64ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=74213800036373104444554012155012&pv=1

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 26 Nov 2022 10:08:48 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1F22 1 KB
643 B 23ms
22ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 65552
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 25 Nov 2022 15:56:16 GMT
etag: 48472445140208031
expires: Sat, 26 Nov 2022 15:56:16 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 489B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43cd61287bb6bcb58e008787ff72083731d9048a6c2d3bec31722c5035ee7d36

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 rar Show response
as.ad4m.at/ad/ Frame 56EB 18 KB
5 KB 62ms
47ms Document
text/html 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb0330bd2c6933cbd29781c40cdc7fe158a5c530011ccc25b8b8ae0e25cae3ce

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7701d3312beb6937-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Sat, 26 Nov 2022 10:08:48 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F22
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJds_r20Pmfggd9yQVTOSFM&google_cver=1&google_push=ASkJ3Fag8PcuqhUQSltbfBJfuNt587tAlKjOMaBNFBf5-idR4bXun3XZXl...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3Fag8PcuqhUQSltbfBJfuNt587tAlKjOMaBNFBf5-idR4bXun3XZXlmlFVv6ZL7b_QhtTrsd0yPBMDi_dttSqQqjCtg07P96p3c6TAUjCKyTKxfc3rS9Fr0...

170 B
188 B

36ms
35ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3Fag8PcuqhUQSltbfBJfuNt587tAlKjOMaBNFBf5-idR4bXun3XZXlmlFVv6ZL7b_QhtTrsd0yPBMDi_dttSqQqjCtg07P96p3c6TAUjCKyTKxfc3rS9Fr0tXeSPIqAey8324hMxWLk&google_hm=8_Q_zrAtPyIQEpbSxFq_6g

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3Fag8PcuqhUQSltbfBJfuNt587tAlKjOMaBNFBf5-idR4bXun3XZXlmlFVv6ZL7b_QhtTrsd0yPBMDi_dttSqQqjCtg07P96p3c6TAUjCKyTKxfc3rS9Fr0tXeSPIqAey8324hMxWLk&google_hm=8_Q_zrAtPyIQEpbSxFq_6g
pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 1F22 70 B
264 B 50ms
48ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESENS_hMtqG5TDKxgrm7HHSxc&google_cver=1&google_push=ASkJ3FbDsM3qtIhaib-BNO_wSz_dCjwMk4F5ylpGk4hLZecj0YrsHZOfE1r_nBaKuEHDtEVqBHzh-JlgSVZm9OjWszGXBKiX_35bIdjltuROD47BjOm99urtKzR3dKiW3tiJ8CIT-PzJ6Cs
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F22
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESENKHtsUauHnIDjr8AyWkx6E&google_cver=1&google_push=ASkJ3FYYVOTbhJCNRsPmADEQ3tDfWov1kR1XY_vKYkv8LhFJlWROj1DylBKdcFcnjC3SbX6ebnq2O07PYdJ...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ASkJ3FYYVOTbhJCNRsPmADEQ3tDfWov1kR1XY_vKYkv8LhFJlWROj1DylBKdcFcnjC3SbX6ebnq2O07PYdJfUM02Iiy-2uAJTdetx4aGOJbzR_Y8cjoT6n9LbErSKu-8rf6...

170 B
188 B

35ms
34ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ASkJ3FYYVOTbhJCNRsPmADEQ3tDfWov1kR1XY_vKYkv8LhFJlWROj1DylBKdcFcnjC3SbX6ebnq2O07PYdJfUM02Iiy-2uAJTdetx4aGOJbzR_Y8cjoT6n9LbErSKu-8rf614cuyn6UNBVo&google_hm=azNidpyTTo6eOh80tMhVgoU

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ASkJ3FYYVOTbhJCNRsPmADEQ3tDfWov1kR1XY_vKYkv8LhFJlWROj1DylBKdcFcnjC3SbX6ebnq2O07PYdJfUM02Iiy-2uAJTdetx4aGOJbzR_Y8cjoT6n9LbErSKu-8rf614cuyn6UNBVo&google_hm=azNidpyTTo6eOh80tMhVgoU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F22
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEK4M7HM9Tm0Q4EqpmOL0IR0&google_cver=1&google_push=ASkJ3Fb5Biw2AxdYAQkkcMBOEoX9OfTwfeZ8DEL1jQ3z1s8aYEKyauQ6cYcDpszD5IkYXCk7OpNgfS5qogoTRx...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MDI2NDYyNTgzNzcwMTI2OA%3D%3D&google_push=ASkJ3Fb5Biw2AxdYAQkkcMBOEoX9OfTwfeZ8DEL1jQ3z1s8aYEKyauQ6cYcDpszD5IkYXCk7OpNgfS5qogoTRxSGxC...

170 B
188 B

35ms
34ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MDI2NDYyNTgzNzcwMTI2OA%3D%3D&google_push=ASkJ3Fb5Biw2AxdYAQkkcMBOEoX9OfTwfeZ8DEL1jQ3z1s8aYEKyauQ6cYcDpszD5IkYXCk7OpNgfS5qogoTRxSGxCmB6SSSg4KhoCZn6O32SxhUMXUyz2TaDGyetk__0IU2YD5t29tdlLg

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MDI2NDYyNTgzNzcwMTI2OA%3D%3D&google_push=ASkJ3Fb5Biw2AxdYAQkkcMBOEoX9OfTwfeZ8DEL1jQ3z1s8aYEKyauQ6cYcDpszD5IkYXCk7OpNgfS5qogoTRxSGxCmB6SSSg4KhoCZn6O32SxhUMXUyz2TaDGyetk__0IU2YD5t29tdlLg
Date: Sat, 26 Nov 2022 10:08:48 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F22
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEFQ82Hk-6wyisteK1uj81-k&google_cver=1&google_push=ASkJ3FbALnGSyuUL-8NXgVMNbOnmVq6WcxHrYjUjPiJltAzoj9DHz5napos_QXps9Bw5oxi51JymktJkMUEvecaH4fYzsJG...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ASkJ3FbALnGSyuUL-8NXgVMNbOnmVq6WcxHrYjUjPiJltAzoj9DHz5napos_QXps9Bw5oxi51JymktJkMUEvecaH4fYzsJGIUAWiYIKFJ7PQXclvJbYVnPeytNhRbPnMWeUFb...

170 B
188 B

35ms
34ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ASkJ3FbALnGSyuUL-8NXgVMNbOnmVq6WcxHrYjUjPiJltAzoj9DHz5napos_QXps9Bw5oxi51JymktJkMUEvecaH4fYzsJGIUAWiYIKFJ7PQXclvJbYVnPeytNhRbPnMWeUFbQLv9ruyhi8&google_hm=NzkwMTIyMjkzMTY2NDc3MTQ3Mg%3D%3D

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 26 Nov 2022 10:08:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ASkJ3FbALnGSyuUL-8NXgVMNbOnmVq6WcxHrYjUjPiJltAzoj9DHz5napos_QXps9Bw5oxi51JymktJkMUEvecaH4fYzsJGIUAWiYIKFJ7PQXclvJbYVnPeytNhRbPnMWeUFbQLv9ruyhi8&google_hm=NzkwMTIyMjkzMTY2NDc3MTQ3Mg%3D%3D
content-length: 0

GET
H3 200 dds
rtb.openx.net/sync/ Frame 1F22 43 B
64 B 31ms
30ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESED7kFfZ5KgDQuM2Jri4NTGI&google_cver=1&google_push=ASkJ3FYtZoZ75W-o9bS1NvAA9btArHv4hwBrdBThQ_Qv_uY64v--tMatxgrSUQTfILg3NmyfgDdU053nA6K2FklLumiewTE3RKROLcjT9YUBwFWkJvwGz8wLJzKmJtH58ANFdyIs3RST9TE
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: nas9p15mcg9h2dkrshbhcb8epph0csp0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F22
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_hm=Y4HlsJm95hzW-femBIQXPgAADSkAAAIB&google_nid=index&google_push=ASkJ3FbL8SCSBMkDsR2JvTmaqn5uIZwzNScGy...

170 B
188 B

37ms
36ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_hm=Y4HlsJm95hzW-femBIQXPgAADSkAAAIB&google_nid=index&google_push=ASkJ3FbL8SCSBMkDsR2JvTmaqn5uIZwzNScGyVNILNJZY_te2dNfCFow4wCjLrvCXyvB35uYBs6vA1D6C0LSf2sWudsfaIp5JB0uhQDX3NPZqqcChpkkrgHKfYlWkkpIuQ4tNafMXlgyhuM

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5R5pcXCOUPTemnoRsaG%2FRzi7JU%2BpdiJJntLj1j8jQSckiSjZHAgQu%2FqPhmOCKMfIrSJgVChI2WV1QC9ZoqdSLZCGpXSVy6TnpTdAGSLEoqezyT3xjg68ts9QvWzxk3TbVSpsXgsrMq5GSw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEGuY-A6yzGorAdCgsfS6ims&google_hm=Y4HlsJm95hzW-femBIQXPgAADSkAAAIB&google_nid=index&google_push=ASkJ3FbL8SCSBMkDsR2JvTmaqn5uIZwzNScGyVNILNJZY_te2dNfCFow4wCjLrvCXyvB35uYBs6vA1D6C0LSf2sWudsfaIp5JB0uhQDX3NPZqqcChpkkrgHKfYlWkkpIuQ4tNafMXlgyhuM
cache-control: no-cache
cf-ray: 7701d3313daa9945-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1F22 0
12 B 32ms
31ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JEAN4NevERYpCGTaJEEeS763E5O7Uh5jbdGfAB7CcQNCCsh8inefi5PHyZ3ddriLCLaV3j

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 css
fonts.googleapis.com/ Frame 3878 4 KB
651 B 31ms
30ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=74213800036373104444554012155012&a=b9b9865b

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfa1ecdb69b9ee93e87159bfcd4ad2b1248a7de0d6346fd42e0b600723ae7b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 26 Nov 2022 08:43:33 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 26 Nov 2022 10:08:48 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3878 12 KB
12 KB 79ms
27ms Image
image/png 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=74213800036373104444554012155012&a=b9b9865b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 3a8bb118fc007851309f243a3ebe997be6f98a308595c75604765759382f39fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Sat, 26 Nov 2022 10:08:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12111
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3878 12 KB
12 KB 76ms
26ms Image
image/png 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/pb_goldschmied_1200x627.jpg
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=74213800036373104444554012155012&a=b9b9865b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 02cae08458ddae1b89ffdbe2fc9386593e052523d4e113ed8e5474c7862508ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Sat, 26 Nov 2022 10:08:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12283
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3878 8 KB
8 KB 80ms
27ms Image
image/png 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=74213800036373104444554012155012&a=b9b9865b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 2e786d13b6268a7a101e83d7222720a7178ff76dfcd780e6cbd8a565f3498774

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Sat, 26 Nov 2022 10:08:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 8167
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2398 0
20 B 60ms
59ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BWW-7sOWBY6bUDL-HjuwP7KScoAkAAAAAOAHgBAI&bg=!MjGlMXXNAAbvMpMzzzI7ACkAdvg8WmWJbsAAO0Lv-0Z0z97ixGuB1HeFQLfxtmc5ux3AZwLLy9E6AAIAAACtUgAAAAJoAQcKALLB7xYcvr04YdzH9hbBRDXdLjU59AUbkkpvEc-rAEL16ul_Xs7DoBYzkUISAuf04fUPoHc5Em0QE47IGfJp1YpuHKaK_k4wFXf9pKbC1kMIzi0KUUP5LZiL-b6MlkRHi2_uO09aB1pvXQEDqxhffiNuB8AFoS7EnqA3T_yBbuvgb22_t1G29fqj7y8_sSZA42I6vEPO1u-V4voIq7mwH1raSiZfBRcWyBFUEhMplnZZRTn2mQLa5JelCegkz878a9yl5FDn7EqQkJByBAxh5ME36ZzIwHqMcp1lhTSmaIsygeDr7zXHVMwbAy7cZfSZ75ooS5s5CfNDPTuRB0yjQl39FwGdLJamKv0e8ZoO7ksIDOU83pWnqX6o98hfPQ3aIWvSD4NlzpCLBesJOUECae8FszSyqwHawStT0uXHE5yN4BUb88WnxJYDVMLxFY8JonV81mj7tKFKKOIx71Py6Z2-w7y--j-zZMWlTjX3v7L3Wx3C5nlBXzHA94HRuImfGXZ3eDMtK6wmFKSUqtfwHg631Q5ra2_IP0DXa2-Rk9vMQMdS23C1-zaOJkCux4PZDeOIZM6hJJxX7_NG3NXd11mE_idEStGScm4rUt_O3EbWxguP0b3Qq7LGJGaTRSrxVBK2l0-NV3iZHz_OjwaxGa-rB6SHYLch_-UJw4uJxec1Og2JISDUcFfC96YHQNOqDEKbdmJWpnrk9vbAATA8xQ45vaenklPhLXPH-Jv5umYkSxa5sRMGHs8jpms8mU_GvxloifHp7rcvlCnUVjbXby1oDpblk7JqWBwrzb5_JYeyyWR0BuK0o90FhmM0YDosHLsl7G-EMHwddcyNC61gZD3my_496HkW1ErinfYxVhry-nbJUzli8x-J2RYYVyfGXyWB6SKyQA10mUNQMMrtGZXbEbOTEFopcmMPZKS6imD1E4lPz9Pmpk9-YBKEvPRyo0KXa743SZIW9VtgSrKTZ9a79B2hWSl03EdlYOqAWudemH46gwqEqFcCrQ-DBeOlKnHZksw44W2dt-6kWgmA2dkj3tYX9_AcFibZMgdB4uI362ju_YY8CbDbiMzvT97WqaVGky9iKiLEXPZZsD6R8Ipntg5arUKUYRU-eldfa30tHi3xWJFbMwRPE2Iy2q1LT9Nc56c-dbwpQ4BlYNskICpyK-EK0Rek8GNHIlqBa09mQy5mxNUyqge-shAdOv4IaA

Requested by

Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 7A3C 102 KB
39 KB 77ms
32ms Script
application/javascript 2a00:1450:4001:801::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2c3cd2dc30d8f3384f6403ba3fe392abaa8786e112aed0a55382a0a0c229c7ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40342
x-xss-protection: 0
last-modified: Sat, 26 Nov 2022 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 26 Nov 2022 10:08:48 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8BD5 0
20 B 60ms
59ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B75oQsOWBY5S1DNjC7_UP-NG4oAUAAAAAOAHgBAI&bg=!xsWlxYHNAAbvMpMzzzI7ACkAdvg8WiSsbMKO39C6-_BdcTdG6LzG2vGs7dTEsEloK41g0DcC90WYNgIAAADEUgAAAANoAQcKAKGBWVbkmj_zOPsiqbdjHxp2ELk86v3WjY2SwnZIDGVQ69uJVOQSPOEpvndTpttmCMwJ-dlM-Gi78LSPKhRnd3hxr3Ua1EV5LiHLmoAqM6KICmUdmYVz9BulDuoB4K3uQFaXaOWmI6XS4BSghnx2uqvjH6La0JTqU-YYoC9k4WBwS82nP4YCnvgwjVcGr1uTrna35M6FwlqRg9EmaPI1dhWfgJkC59-J3q3EV_i0Xb6QsmtpsE46kM93mn_tlKftH31HTYn1zS1rduoHxC_Py1cg9rNEXduXNSCmlu1wdJF729udiEPNKDb9De7aaaPiW_Fmp6hdlrm3TM2vrAyiCqc8NzYQU-llUYbBCQqVBFHd_q1HIOu20Hh02WnRJflGVXykwuATP01Gt9yn901_vDWJpPF19wfsg2B_bZbT2IsD0uI5W7o7Xg4ev1HssqhxzQ4boxK42F1lcacAY0D9ezPETjOj1TucU4xeq4J-DzHQW6Vz1K-TzU2kB78E3I1ZrHsdsm1uzQsf18vF-NKQx6fSPCh1hzuVB1lK7CGl24FVrbzn3TnERJJT-wApj1ZBQ22n34YG7_yVoe8oeiN1inwNbc3gN6FhAtYe_-msUyv5EcDIRQqNALjawWGEKrp9u0KUswZHEE77GxSSlWoP67h_d0kZgVgMx45yj6hth1iuI50eZFpcs4AMlLL2D1Pb_aGV3YGPbuDMveS8EVvQ3qc6HcFt5jCNz_uAdLH8ioSxhttfTvAuYwWurs-aScPQbVKARtM01_K5hIEM6wQ5d1ixSb53kwrxsfaXRPmg7bYg_eFp9ZtzpLdv_9wBVaHZLeh1L0HA9o4MXtPG21tsPNKAvASxbkrjug0Ko94FfHkDQAk0s2qw-nRg5m43pVM_N0wKzPL9GVOb7Wbu3Ybzv7bACY6pRHwdPwFfkaQXPLD6a5lP9b_ehl9NCv2S_hLck3aotVySjbcTDD1Z7ISYd3_rwPEl8kWWtf4RgHCaoJbKteDh9fSLtQpsVsgA57rSmSLND0AdzkQ-9FRuc4stej9B6oBYhfq0T6aEjwi_0XT-qMLI5XE3qhrVbuvK3eMWpVNfGt9vO5f5rSATIFvXp-W8YXluPxCI_D_d2sYhgx8AwyuhGBM9069pupFt0sheekoCFuPTf6r-gxJDXsVSD-lB-6r8y14UVKOohVXTt38nbPA9E27ANnWt4AsY

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.25/one-ad/ Frame 56EB 89 KB
11 KB 40ms
39ms Stylesheet
text/css 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.25/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ab995345cf38f3951bc840ab2c0d043269e700e59f1c6d6cb7fb8946268b358

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1669235721
age: 220229
cf-polished: origSize=91628
x-guploader-uploadid: ADPycdtnqpkBC2eNpIttCC4X9D-yrOoXK0HfmyiASnHmc5dpKNlZrWHuml5v2FihfATK0UIibbwmZ2MH5YrFqJYKDzRy-A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 23 Nov 2022 20:35:56 GMT
server: cloudflare
etag: W/"575def06e70febb0cbd25403e37880bf"
vary: Accept-Encoding
x-goog-generation: 1669235756372606
content-type: text/css
x-goog-hash: crc32c=ttlcew==, md5=V13vBucP67DL0lQD43iAvw==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jZUyKKe9Z%2FWSEMJVYBSOEvNLI2NWu6%2BFRTLq1JL1IzOjoDppVb9lIeLRsS%2F5UN2Ra3tkviZ2AUBNzNhvuOrX%2BCGiF6MVsuBaQBux2ej8Lce6Lh37R5SdeNQM8wlpz%2BIEcrqVKA34PCA%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 91628
cf-ray: 7701d3318cdc8fe9-FRA
expires: Sat, 26 Nov 2022 11:08:48 GMT

GET
H2 200 F9B39585BFA0505D63AEC15D6DB1B02D9089CB0BB1445FD9678DBB04C32C81A56DC3B966E24F60B1752A92F908AA27DE3F0994E5B1621436EB0D2328EC61055B
assets.ad4m.at/logo/ Frame 56EB 127 KB
128 KB 74ms
63ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/F9B39585BFA0505D63AEC15D6DB1B02D9089CB0BB1445FD9678DBB04C32C81A56DC3B966E24F60B1752A92F908AA27DE3F0994E5B1621436EB0D2328EC61055B
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 418c1cc5e3fe5dab64df68fee91403c4af6a0b5ee68f12c2717956b216b08b8b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 576520
cf-polished: origFmt=png, origSize=233620
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 130162
cf-bgj: imgq:85,h2pri
last-modified: Tue, 29 Mar 2022 07:10:51 GMT
server: cloudflare
etag: "d1d171dd651522f41a2fc0dba256a546"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LutTlVjsmrjTPaimMqPZDKGIk0Xtv2PjAMJN90Msu9QKcn%2BNelmJEUbRSbQFIco7u%2BmUB21R%2FMDN61LIgH4KrcL2Ot7mnXcNaz3AV4LE4LRJz8YnQvvdDhPyrjAEDFD2mFOgdoEGkueYrl%2F%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7701d3319ce36937-FRA
expires: Sun, 27 Nov 2022 10:08:48 GMT

GET
H2 200 1408E404D125984EC307986C30204BFB93CEF5A079A8B664A2AB24EB8E10E04B06FC2810F2A3432611FA8E4EB56D40C4CE476E3578F76162AC45AD15ADEE2CC0
assets.ad4m.at/product_image/ Frame 56EB 461 KB
462 KB 53ms
46ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/1408E404D125984EC307986C30204BFB93CEF5A079A8B664A2AB24EB8E10E04B06FC2810F2A3432611FA8E4EB56D40C4CE476E3578F76162AC45AD15ADEE2CC0
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec335cbc056796d69797fd1ef82fc0abd9159579add0bf72e3f54fc0acba786b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1776576
cf-polished: origFmt=png, origSize=731561
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 471752
cf-bgj: imgq:85,h2pri
last-modified: Tue, 29 Mar 2022 07:03:31 GMT
server: cloudflare
etag: "1b69278243c107df5b11186b1f6ca585"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8cd2Drl3bCEL7OmESxE0PgQEY5csNoneZrrVEXnis3qiX5iauYJ5h233lvoZNg54f3M%2F6mbttEnk7pNoCMu6msaeUa11Rtzbd3VLF0yb2dxKoveNe17%2FqxzKokGeXLmwuXYru%2Br%2F4%2BnbyDzR"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7701d3319cdd6937-FRA
expires: Sun, 27 Nov 2022 10:08:48 GMT

GET
H2 200 B540011309A7A223CA190FD615D127B7570B1721E653B82E0DAAFC2C259A71C0F7A4F55653D39625199B295853A73F49D4B1D98FEBCF9E844CFCAA1103DBF4F7
assets.ad4m.at/logo/ Frame 56EB 63 KB
63 KB 76ms
69ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/B540011309A7A223CA190FD615D127B7570B1721E653B82E0DAAFC2C259A71C0F7A4F55653D39625199B295853A73F49D4B1D98FEBCF9E844CFCAA1103DBF4F7
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64ee900286c520753f34371eafdc56c97188e32638a97eaaf5e5b60afdb4064f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2469528
cf-polished: origFmt=png, origSize=89638
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 64408
cf-bgj: imgq:85,h2pri
last-modified: Fri, 22 May 2020 12:20:14 GMT
server: cloudflare
etag: "5260549f152cd629e826b547dd714c3a"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B86I%2BuNvQoPLmQclCzTVAc%2BCpGGcfiOdHiaKwOun3WTtD9B1N%2BXzoeL0CUdvxbAqfpwwI3pcx55htYXj27a1kPVuxuptR60byUty%2FdcjKxdMhuMHRevfvBk0tKuW7PVm3RfPat%2BwAhXsu3Jl"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7701d3319ce06937-FRA
expires: Sun, 27 Nov 2022 10:08:48 GMT

GET
H2 200 C56693D9A1B08B42506D042029986348D3C5B748950763FE678C4ED7115C882C37EE23A3213A99CBF6307528E019DC6BC2DD9649960D0B55F98BB6E5636CA060
assets.ad4m.at/ Frame 56EB 29 KB
29 KB 43ms
37ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/C56693D9A1B08B42506D042029986348D3C5B748950763FE678C4ED7115C882C37EE23A3213A99CBF6307528E019DC6BC2DD9649960D0B55F98BB6E5636CA060
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14538419c15807c9a5e7d913afbb17223f76134b8da12b51574a7d13ee4046c9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1781669
cf-polished: qual=85, origFmt=jpeg, origSize=68718
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 29350
cf-bgj: imgq:85,h2pri
last-modified: Wed, 18 Mar 2020 10:20:14 GMT
server: cloudflare
etag: "3608be436fa33cfe8447c6f429d36a9d"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BetU%2FT82wElh9TS55sfcA168wh%2BqrgmLTREpr21Bby2rvvicYObTNsaPab%2B71rUpiw%2B1M9Ex5WC2lqma5CygnelTCjU%2FXPNsf7xuLAWemz%2FzBIJ8fY00rHQMxxkdR98rmphCgreBM5KvMZZH"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7701d3319cda6937-FRA
expires: Sun, 27 Nov 2022 10:08:48 GMT

GET
H2 200 B6C55515525C2192B97E1253116BAA5C685DD07AF79BB6C9C4097CAEDCCAF04D1DC2B7B5FD417FB88EA0B39E23DED47A8BBF448407373E4FBED422FA6A33EF14
assets.ad4m.at/logo/ Frame 56EB 26 KB
26 KB 69ms
62ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/B6C55515525C2192B97E1253116BAA5C685DD07AF79BB6C9C4097CAEDCCAF04D1DC2B7B5FD417FB88EA0B39E23DED47A8BBF448407373E4FBED422FA6A33EF14
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90cbcae2f75cbdcf2a00d82c83cb2926f1a4ad7ab38eb3d629f2e7d3ad72410e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1779726
cf-polished: origFmt=png, origSize=53992
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 26236
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Jun 2022 14:47:26 GMT
server: cloudflare
etag: "e460905652d65e6a54a57da046f52d6c"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=daSX82wrVM1inQD%2Fah27j6iWNUqJAahh7k%2BFajHOhdehYvzPUZM0bLMoIfw1VkUyGby38pBr6cZ9KuuRnp6qIp3BEZZYuxhtWG2%2B7zLOu8lmEujGAZE9yeqv4EwN6miuR0RbE4axCfIkSPCX"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7701d3319ce66937-FRA
expires: Sun, 27 Nov 2022 10:08:48 GMT

GET
H2 200 A36DAD0D440985CF6ABFA23492945CE5BC6D94350A66B19418CB771AFE823AD9B48ADE8E2F007546F0A50A710172EEFC2CAC1468E38852CE2028C22592AAFB75
assets.ad4m.at/product_image/ Frame 56EB 54 KB
55 KB 86ms
80ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/A36DAD0D440985CF6ABFA23492945CE5BC6D94350A66B19418CB771AFE823AD9B48ADE8E2F007546F0A50A710172EEFC2CAC1468E38852CE2028C22592AAFB75
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8928a20b6d9520af9bfb5e9748259fc3c1ed52ee4e430920d7e70897af5c065

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1175953
cf-polished: origFmt=png, origSize=105738
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 55798
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Jul 2022 08:55:40 GMT
server: cloudflare
etag: "147be38db57f89c69c9e65b05983ff0e"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oh5EFbYOV9akpWly9PSUlh4ID1M6b9iTZMpEOqVLFtYhpy6Rn32VTBkZwvfBYy4NsCvNfhHtTFwn5MtxKvX0WXMS0%2Bwasv7uJRs0ldd%2FsqJXh02xUeH6Ml%2Bfn5osVQarzD0XZCJD3psmDokm"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7701d3319ce86937-FRA
expires: Sun, 27 Nov 2022 10:08:48 GMT

GET
H/1.1 200
OK viewability Show response
hal900012.redintelligence.net/ Frame 3878 0
150 B 77ms
26ms Script
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900012.redintelligence.net/viewability?s=74213800036373104444554012155012&a=329c0ed4&vb=m
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=74213800036373104444554012155012&a=b9b9865b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/request_content.php?s=74213800036373104444554012155012&a=b9b9865b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Sat, 26 Nov 2022 10:08:48 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 3878 13 KB
13 KB 21ms
21ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900012.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 09:39:30 GMT
x-content-type-options: nosniff
age: 1758
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13052
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 26 Nov 2023 09:39:30 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 3878 13 KB
13 KB 22ms
22ms Font
font/woff2 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900012.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 17:43:57 GMT
x-content-type-options: nosniff
age: 404691
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 17:43:57 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame 56EB 1 KB
2 KB 74ms
74ms Script
text/html 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2194035&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1gzmmcae7xy4612vy7ja862n9wr0mz19g63hy9j60sjb1tmy1bfve1pjvbympj76g9g5rdz5ra29b316255rrhrvj7yg6w3yasjg97gwb0wpbpk42p8z897tm4k491vxnn9g27zgq1hbfmhd6xh80aywrpb7myxsfeh0972yx9et24zx0v3x0mj021fd5d14vcsjetmr8p6vgy2pcj8eqfq70a9brtsjg396k86jtst9egt97gskrkbac2bantt1%26a%3Dhttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fdbm%252Fclk%25253Fsa%25253DL%252526ai%25253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%252526num%25253D1%252526cid%25253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%252526sig%25253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%252526client%25253Dca-pub-1062972861553303%252526dbm_c%25253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%252526cry%25253D1%252526dbm_d%25253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%252526adurl%25253D&clickref=oneidWKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2oneid__dbm_Netmix_Reach02_DC&viewref=oneid3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBudoneid__dbm_Netmix_Reach02_DC
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 1f88950c9a729ba2d0a09d77977578b01aea68a66d1aa1a2a0c14a31065f9911

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
last-modified: Sat, 26 Nov 2022 10:08:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sat, 26 Nov 2022 10:09:48 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame 56EB 1 KB
2 KB 124ms
123ms Script
text/html 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2611455&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1hq8fy2p6x905wnh1kz8q9b0fh98ksvwafq2mccx1egz04chsm5696gp3z72z096j2wbpk3amkagmjvj975b7hv4gfdv4k0gtk2d67y22mjjz8sfzdm1rq91p9q3hfsaj8k0fzpgah9qw1vbsrbmh8nqx6xtmyrj6xca9fsswz4y67tqthhvx2s7evcj0y59n3gj3qp0vnyte4a6xq929h1z3kegvyd4scv4qncwtczczjqs1wxkjv991bd6fqr%26a%3Dhttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fdbm%252Fclk%25253Fsa%25253DL%252526ai%25253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%252526num%25253D1%252526cid%25253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%252526sig%25253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%252526client%25253Dca-pub-1062972861553303%252526dbm_c%25253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%252526cry%25253D1%252526dbm_d%25253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%252526adurl%25253D&clickref=oneidjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9oneid__dbm_Netmix_Reach02_DC&viewref=oneidBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TMoneid__dbm_Netmix_Reach02_DC
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: b6acc527f8709599540d79d3f1b4f82e190129eb16161aa0af813b5d7ba9765d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:49 GMT
last-modified: Sat, 26 Nov 2022 10:08:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sat, 26 Nov 2022 10:09:48 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame 56EB 2 KB
2 KB 81ms
81ms Script
text/html 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3641431&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1kp9cppn6ybja80vqh3ky19s7j6bf5jkw2aws1gn0q17qjx8230xyk797st7fcs7978sdeykgqmx33fnvf94fgj40rgyk463cghjncjg9bfb4gpbjydw34rbr60w0eq4h9whskz0y9363xhs80neyq6nzfwy17z2c5y389tfztgc4xb5fxm68scb806d1w94m3p42qs6byftekpgt041x991f0nq3rtj9rnx28h47sf0m6dvvgh8nw2n0xzhjqmh%26a%3Dhttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fdbm%252Fclk%25253Fsa%25253DL%252526ai%25253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%252526num%25253D1%252526cid%25253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%252526sig%25253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%252526client%25253Dca-pub-1062972861553303%252526dbm_c%25253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%252526cry%25253D1%252526dbm_d%25253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%252526adurl%25253D&clickref=oneidk57C5f3fd65qF4HwHetmCX3qkfZSjTmEuRoneid__dbm_Netmix_Reach02_DC&viewref=oneidK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTqoneid__dbm_Netmix_Reach02_DC
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: f6bbb2cd2eef9408358754e0e60106f8e0c5e8e926cc118aed6138042f0dcf18

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:48 GMT
last-modified: Sat, 26 Nov 2022 10:08:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sat, 26 Nov 2022 10:09:48 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 489B 85 KB
31 KB 89ms
25ms Script
application/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=74213800036373104444554012155012&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5f0e58e4c8d23cb8d1453aa9d362f102a4676085ab517acfd34aba74f982d3db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 06:06:18 GMT
content-encoding: gzip
via: 1.1 9c920cc684a38b53bc9c7a44ba794874.cloudfront.net (CloudFront)
last-modified: Mon, 31 Oct 2022 15:47:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 14552
etag: W/"faa933973c404f8cfedacd4b67a60b85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 7YCz9VCb5y4CAqd6cKMwyPZIcKBP8IfWLVwYRT71ix1wxjusZcmCow==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 489B 3 KB
3 KB 78ms
23ms Image
image/png 13.32.121.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1669457628&Signature=VPTGbM60RYChUgPORrtKSrNhpk9yyX3Fpl7yCouKo7zI8mwU4S2twjSuiJ67RTCtvCYb3TZ-h70CDcEXVqA-jpLrXE6MtkJpAsEjFgmd2vz8tuX4p0JgZC3PGqtnyagqea5~kreOxz-zr4r8XLdP7S95zgzQQ-CjrieWAl15LVux-DS51bE5-ZldVh6Yn-5B23BkEBi4anTyPodTa7MJv-ogG6E3rUOiNzsy8JIQb4x0vmascEW8iIEQX~WCGJL7TCrBM-XVHlw83AMBYxG~2JFzj6IuqQeGbLqEEZWpDSjdbolLuQVcfm017uZKzrriCRHrnyMdLNhuQFxcuUeB3Q__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
URL: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-66.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 25 Nov 2022 10:36:11 GMT
via: 1.1 adc51edbb4dc468fb382e40b115a2f62.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 84758
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: jW6kgaDyIwo7rclwmWvAz7IlOcyZM1SKfucORuhSOPDV0bUqQMBaXA==

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 56EB 85 KB
31 KB 82ms
43ms Script
application/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2194035&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1gzmmcae7xy4612vy7ja862n9wr0mz19g63hy9j60sjb1tmy1bfve1pjvbympj76g9g5rdz5ra29b316255rrhrvj7yg6w3yasjg97gwb0wpbpk42p8z897tm4k491vxnn9g27zgq1hbfmhd6xh80aywrpb7myxsfeh0972yx9et24zx0v3x0mj021fd5d14vcsjetmr8p6vgy2pcj8eqfq70a9brtsjg396k86jtst9egt97gskrkbac2bantt1%26a%3Dhttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fdbm%252Fclk%25253Fsa%25253DL%252526ai%25253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%252526num%25253D1%252526cid%25253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%252526sig%25253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%252526client%25253Dca-pub-1062972861553303%252526dbm_c%25253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%252526cry%25253D1%252526dbm_d%25253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%252526adurl%25253D&clickref=oneidWKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2oneid__dbm_Netmix_Reach02_DC&viewref=oneid3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBudoneid__dbm_Netmix_Reach02_DC
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5f0e58e4c8d23cb8d1453aa9d362f102a4676085ab517acfd34aba74f982d3db

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 06:06:18 GMT
content-encoding: gzip
via: 1.1 9c920cc684a38b53bc9c7a44ba794874.cloudfront.net (CloudFront)
last-modified: Mon, 31 Oct 2022 15:47:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 14552
etag: W/"faa933973c404f8cfedacd4b67a60b85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: JEB_viLBcFzB9nXgJlrmdCzA6qLQ7lNkD7wq4hqx3nszPNe062XIdQ==

GET
H2 200 link.html
track.webgains.com/ Frame 56EB 48 KB
49 KB 98ms
98ms Image
image/gif 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgdedup=1&wgcampaignid=1384975&viewref=oneid3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBudoneid__dbm_Netmix_Reach02_DC&wglinkid=2194035
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: e634cdea6fc8a42921753f7da1799c4719b763400d8891a778bdcc519e43c919

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:49 GMT
last-modified: Sat, 26 Nov 2022 10:08:49 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sat, 26 Nov 2022 10:09:49 GMT

GET
H2 200 1619604937_fPkEZHu3MNy3GC7XuV3lA1s9E5XlSAcF.png
cdn.track.production.webgains.team/286305/ Frame 56EB 15 KB
15 KB 49ms
27ms Image
image/png 13.32.121.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/286305/1619604937_fPkEZHu3MNy3GC7XuV3lA1s9E5XlSAcF.png?Expires=1669457628&Signature=ZrLKxuVx298TcX7UVBQ2JVi6xGpArX~U1wMQe8YYZhXJNGskJSxp-qjJ4DopDkWGzGtwa5xd4Cim~PFw9kIq-K-ZBWGmeAs4MoI~U8gSLt2EbghWJdWmp10PLSgwosw2fMEbLh5m4k8V6~AvQxM7D1xcJyS3uibyYrEywUVjEK1lwqX3PYZc0qQ0XGb2GS1fkaZ8xi1iyWUD8pnltr6mFrYvCwDqQIL5amn5-ePIJuNQ2ZMsuPlaLXytBhpPZoLzWNXNx0Jo5HTqSaer8roV0SyFNXgDOCsDky3I-WKe4b9PJyfRomQXjHm0kEHPwg2ViJwMluDSQ7dMBcoXUsGEZg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-66.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 60bf02832688d14251ec1c7b8acfda233a91f927f26c7202bdaba781a1f0fcdf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 25 Nov 2022 21:40:01 GMT
via: 1.1 adc51edbb4dc468fb382e40b115a2f62.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 10:41:35 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 44928
etag: "d4e8f970f24f6d19b53aa92b1907c1ef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 15054
x-amz-cf-id: TNazAi7TUFxPqGv4p5lJIDlEHT4qtEv1h_DjiOY0LojhuNzSN1jarA==

GET
H3 200 dc_pre=CNO_t5jNy_sCFQjMmgod8QAJLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5155768703976.837
adservice.google.com/ddm/fls/z/ Frame 3F88 42 B
63 B 58ms
58ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNO_t5jNy_sCFQjMmgod8QAJLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5155768703976.837

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CNO_t5jNy_sCFQjMmgod8QAJLg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5155768703976.837?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 link.html
track.webgains.com/ Frame 56EB 3 KB
3 KB 89ms
88ms Image
image/gif 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgdedup=1&wgcampaignid=1384975&viewref=oneidBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TMoneid__dbm_Netmix_Reach02_DC&wglinkid=2611455
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=183975%2C22122%2C197862&b=3P2Fpf4fXBjga7HrHAtEt9ZrSPSWTKBud%2CBjgCgfPfAb5cxH6H3t9tJ94FjSeT85TM%2CK1gcRfZfGBmzU5HMHktPtK13Yf7SAT8gTq&f=WKGsrfdfZYM6UYH5HjtDCXz8H3SETVxu2%2CjpEsEfGfQp6TYHEH2tWC3jDcZSzT14F9%2Ck57C5f3fd65qF4HwHetmCX3qkfZSjTmEuR&c=728&d=90&e=&g=bc2c7af1b5ba7fb2b9aaaa603698da7a%2F7005394411361941473&i=20597%2C16804%2C71725&j=21%2C21%2C21&k=0&l=0&m=0&n=&p=&q=&o=dbm_Netmix_Reach02_DC&r=1669457328758&h=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%253Fsa%253DL%2526ai%253DC84-rr-WBY-WxFaatmLAPiYa0uAHX3-XHba3v_6n8C_OZk8bDGhABIIb3hiZglQLIAQmpAv1d4nqfcLE-qAMBqgTVAU_QS0uRIKNq976IOYytfMyniHLPCV9DcyUiotzR5r1OBp0YKw5C9P5EE-k_68_JDo4T5XtXt4otNEI42hs7DlrHlfi_ko_-b-QusVgMnJfh0FToQrSHAd02AsT9kG1oUan-MGpe31RexDPuW9mrQgbZoJfUEN3x_D17bMfgFJSbJeaa8pPFm6aMDXs1cNrIYOXOhB0u70j3MdPThX2cKYzuko11dzplMNvlOu5RnMMlSBW-44FUEMPo3WcFLXUis1WG_p7E6FZ6bSEUE--UJuG4W-ByAcAE0pGd3PkC4AQDkAYBoAZNgAfqk59DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoDmAsByAsBgAwBsBP6qNQG0BMA2BMDiBQB2BQB0BUB-BYBgBcB%2526num%253D1%2526cid%253DCAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM%2526sig%253DAOD64_3SqFtdMngyeQnuwPUuvZVdgjD94w%2526client%253Dca-pub-1062972861553303%2526dbm_c%253DAKAmf-D7OnpzmTbfVVQZSTqHTv1Vm_Qcf3OZPxNCVaLS2gbnFN1cmchwdc4Ov26afeTR9nBl6rM47JAo0XxPNk7JzXGz_jayD2F3IChnwI4TIWI7_5hUfW7XtPM_4qA7iYBz-bAvmPOyXXiIzf4zUuljs7trbBAEd5GYsX291AUILMIfhgMjURo%2526cry%253D1%2526dbm_d%253DAKAmf-BznlRzSghcorOIcuCZxUwlLWVh-wUo7goNLp4-lzkhevn4KRL1vSP56GGf_JIsyyOqeqbfCq34AYCSjOAPXbO9TieOsVZR_FY3B8LvotheUG2bHUoJlLEZhvwRtpsKARvsFNJXGBspXrQ9VUPJm9Xm2T_uf5Tqm_j4oHdEsS5k21LmT1XKCL3o93hPmVdInZSiS_y7Drbl6zfUGgOGkmq08y9IZ7QAhq4qD5dqrept9bHjkmcaSbyHQtJTcB6ILqJ_O8-f6xQmfM-ZMt_ORLqOHiq5Vh2VpIg31CfEcg3i6slqEen_elVd1XeIrCGJc8S2Kn1A1ThLHVTvVvVIi7spJf7d1t39HpunVDl4CvQNEwxD7JZ9tcZwAzi3-9xADmyEKRENo0aAOeEQKVcKlw-HtrD_TE4lwV25rGRg0j1fJbS2CrdSIu5sIg6ntmA8sklSviZG5yU01qm1MJ_I1RK06S4rXGRloduwYa90rwZLO9ikG8WsHQM_sEAL9rxOOVgFAlHpaL17GUZrBnI78ZxFoAwapWPU3Fm9yhgIVBs6kIk0DAdQNnL390HYJmoUK0-Uzk_3rfhUlXFDqFQ6uZU-NQXGBZv0CQqlxDBwPNtASU_3GZU%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 0bb7d041ebd9fd009fc12482885c6dca63ebe0ca1b9ce960bbd047a0e5391cb5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:49 GMT
last-modified: Sat, 26 Nov 2022 10:08:49 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sat, 26 Nov 2022 10:09:49 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 7CCF 42 B
64 B 65ms
65ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvAMb1fBU1ZkF-hO3iQRwnPC9s3G5IHL7QBddJ6Ym44_ubBJVGyhwYBDpnMrsoWkxzKLTz1h3ZD-u3gxqbhh5wRynwZSQ08vOmGhssA8vTLiPQS-vNy0tq9KRq4FaDLBIBzfnX0Uw&sai=AMfl-YQpKeaiS2IimZHezJocJG1Yz4gWmR_VvmUOD1Ma4p6eMbsmPn8rP6a_zEs0MukDamgmuRQ2owXH-jSaC-yCa6IKTOCOUst4CqZnqgAxwTG8xcEfkbKt5R0U-zccZmw&sig=Cg0ArKJSzOH7pwWDNn38EAE&cid=CAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM&id=ampim&o=315,150&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=307&tls=1307&g=100&h=100&tt=1307&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EDF0 42 B
64 B 60ms
60ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv9OuNqJKey-ajWwtDQ5lyVlGKogccSO17TvKUv7Vgk03Sqcqjlac5S-aYgF2jsDI0wPsjI-u_zCod5xs9KjJSKinsrFedacoR9q2x8yBx9fcwt3X9vCE47_k0G&sai=AMfl-YQhi8BiK3cbhHaZW-lHFRsmdAEY0Z6iI9QsPkf-5LuflQUGlYndh17DUOqy92gRqSyI4l_ZTWq57ddnOZlPDc2mlD_LLuRMADnRlzT69vBZCxtl0rc_m_mIP6-wyN0&sig=Cg0ArKJSzHtUDkRoS46BEAE&cid=CAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM&id=lidar2&mcvt=1000&p=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4224052327&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669457328086&rpt=367&isd=0&lsd=0&met=ce&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame C66D 281 B
554 B 79ms
23ms Document
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: d29xw9s9x32j3w.cloudfront.net
URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 26 Nov 2022 10:08:50 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK viewability Show response
hal900012.redintelligence.net/ Frame 3878 0
150 B 80ms
27ms Script
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900012.redintelligence.net/viewability?s=74213800036373104444554012155012&a=329c0ed4&vb=v
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=74213800036373104444554012155012&a=b9b9865b
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/request_content.php?s=74213800036373104444554012155012&a=b9b9865b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Sat, 26 Nov 2022 10:08:50 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 489B 42 B
64 B 60ms
60ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstmhKyINGR_UhPQGtexHnm1Lzo-P7WldDPSsoSVQt8oUQ56BDVDG8zvjQTlRlFS_gFrMjkG5Ed8yROciFCe0MIgXa_-drgimG9Xm6T_5USb_Cw_x9Rhu1LCZT9Z&sai=AMfl-YRRbH7fhPZrwo0y59ZLqIajyuTTIjtu3d_TlZUYXjVKR2WlxM0UD-ZX1a4SyKbaa3E9kcCnIaM_EHZaVAiEvLajryy8bj60WIookYo-l2ISRJjFZ92i-z6EXMlwkUw&sig=Cg0ArKJSzJxm0MYNzr8IEAE&cid=CAQSPADq26N9J-8ei4R7JEGIYMd1J8IPdMWUOJqr4chmbXGDrRC7oLHutTHBxub53kTAYmAo3DdetXhxOMx1kRgBIBM&id=lidar2&mcvt=1318&p=495,1250,745,1550&mtos=1318,1318,1318,1318,1318&tos=1318,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4043710201&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669457328082&rpt=702&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame C66D 34 KB
10 KB 24ms
23ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: a6768b654501f9e809927bdad16f288267e18e404bedec7f6a729429c040c1e0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Sat, 26 Nov 2022 10:08:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 25 Nov 2022 12:55:12 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=10041
Connection: keep-alive
Content-Length: 10066
Expires: Sat, 26 Nov 2022 12:56:11 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/
Redirect Chain

https://dsum.casalemedia.com/pbusermatch?origin=prebid&site_id=754850&p=1&i=0&gdpr=0&gdpr_consent=&us_privacy=
https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_&gdpr=0
https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_&gdpr=0
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=4I0UJMK01OYS785&gdpr=0

43 B
766 B

71ms
24ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=4I0UJMK01OYS785&gdpr=0
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 26 Nov 2022 10:08:50 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sat, 26 Nov 2022 10:08:49 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/595ea14#595ea1444a96c0bdac4aa333a73d7028cf966fc7 i-001aff4bca77297e8@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=4I0UJMK01OYS785&gdpr=0
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cm
us-u.openx.net/w/1.0/ 43 B
75 B 32ms
31ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcs.media.net%2Fcksync.html%3Fcs%3D8%26type%3Dopx
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:50 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=adtelligent
https://sync.1rx.io/usersync2/rmpssp?sub=adtelligent&zcc=1&cb=1669457330387
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=7153636824

70 B
264 B

48ms
48ms

Image
image/gif

52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=7153636824
Protocol: H2
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 26 Nov 2022 10:08:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:50 GMT
etag: RXe2c5ab9b3304455bb71f294e510c9bb0003
content-type: text/html
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=7153636824
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET
H2 204 /
onetag-sys.com/usync/ 0
38 B 26ms
25ms Image
text/plain 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/usync/?tag=img

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip252.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-store

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid
https://p.rfihub.com/cm?in=1&pub=20513&ssp=themediagrid
https://x.bidswitch.net/sync?dsp_id=119&user_id=5107433825389010756&expires=30&ssp=themediagrid

43 B
145 B

22ms
22ms

Image
image/gif

52.28.76.191
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=119&user_id=5107433825389010756&expires=30&ssp=themediagrid
Protocol: H2
Server: 52.28.76.191 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-76-191.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 10:08:50 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

Location: https://x.bidswitch.net/sync?dsp_id=119&user_id=5107433825389010756&expires=30&ssp=themediagrid
Date: Sat, 26 Nov 2022 10:08:50 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 56EB 16 B
232 B 89ms
87ms Fetch
application/json 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 26 Nov 2022 10:08:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 136ms
41ms Preflight 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sat, 26 Nov 2022 10:08:50 GMT
server: nginx

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame C66D 284 B
536 B 95ms
24ms Image
image/jpg 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/jpg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 284
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 56EB 16 B
232 B 93ms
91ms Fetch
application/json 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 26 Nov 2022 10:08:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 116ms
41ms Preflight 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sat, 26 Nov 2022 10:08:50 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 489B 16 B
232 B 75ms
74ms Fetch
application/json 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 26 Nov 2022 10:08:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 107ms
41ms Preflight 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://a4e14440b32567b2a2fb0bb3b0a9126c.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sat, 26 Nov 2022 10:08:50 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 56EB 16 B
232 B 82ms
81ms Fetch
application/json 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 26 Nov 2022 10:08:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 104ms
42ms Preflight 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sat, 26 Nov 2022 10:08:50 GMT
server: nginx

GET
H2 200 cms-2c-rubicon.html Show response
cti.w55c.net/ct/ Frame B0A1 52 KB
13 KB 117ms
20ms Document
text/html 192.229.233.53
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cti.w55c.net/ct/cms-2c-rubicon.html

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.233.53 Saint Joseph, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6752) /

Resource Hash

ecb740996ce05e9b7823c9690564a0d7b3840becad640d37e929cd4f4ee1cdf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://eus.rubiconproject.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 39240
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 12841
content-type: text/html
date: Sat, 26 Nov 2022 10:08:50 GMT
etag: "3055990060"
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Thu, 14 Oct 2021 17:36:30 GMT
p3p: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
pragma: no-cache
server: ECS (frb/6752)
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
x-cache: HIT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame C66D 0
239 B 26ms
26ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 611afce88997db6fdd35eb213e662871
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 204
No Content token
token.rubiconproject.com/ Frame C66D 0
214 B 26ms
25ms Image
text/plain 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 204
No Content token
token.rubiconproject.com/ Frame C66D 0
214 B 51ms
24ms Image
text/plain 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=25470
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: 0
Pragma: no-cache
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame C66D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDhsbalz64yiYJAW8zOeUVk&google_cver=1

0
239 B

24ms
24ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDhsbalz64yiYJAW8zOeUVk&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 611afce88997db6fdd35eb213e662871
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDhsbalz64yiYJAW8zOeUVk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame C66D
Redirect Chain

https://sync.1rx.io/usersync2/rubicon
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2101097478

70 B
264 B

48ms
48ms

Image
image/gif

52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2101097478
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 26 Nov 2022 10:08:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

pragma: no-cache
date: Sat, 26 Nov 2022 10:08:50 GMT
etag: RXe2c5ab9b3304455bb71f294e510c9bb0003
content-type: text/html
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2101097478
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame C66D
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=88053b98-840a-4210-9239-e071a69a3679&expires=30

0
239 B

25ms
25ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=88053b98-840a-4210-9239-e071a69a3679&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 611afce88997db6fdd35eb213e662871
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=88053b98-840a-4210-9239-e071a69a3679&expires=30
Date: Sat, 26 Nov 2022 10:08:50 GMT
Connection: keep-alive
X-CI-RTID: dda62559-0f8b-4ca3-b97c-85849d72dbf3
Content-Length: 144
Content-Type: text/html; charset=utf-8

GET
H/1.1 200 9.gif
id5-sync.com/i/175/ Frame C66D 43 B
1 KB 23ms
22ms Image
image/gif 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/175/9.gif

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 , France, ASN16276 (OVH, FR),

Reverse DNS