www.save70.com Open in urlscan Pro
107.154.142.143 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://save70.com/
Effective URL:
https://www.save70.com/
Submission Tags: tranco_l324
Submission: On November 24 via api (November 24th 2021, 11:49:44 am UTC) from DE — Scanned from DE

Summary HTTP 177 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 44 IPs in 7 countries across 37 domains to perform 177 HTTP transactions. The main IP is 107.154.142.143, located in United States and belongs to INCAPSULA, US. The main domain is www.save70.com.
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA H2 2021 on September 6th 2021. Valid for: 6 months.

This is the only time www.save70.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	107.154.139.143 107.154.139.143	19551 (INCAPSULA) (INCAPSULA)
3	107.154.142.143 107.154.142.143	19551 (INCAPSULA) (INCAPSULA)
3	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
52	2600:9000:215... 2600:9000:2156:e00:1:c9ba:9380:21	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
2	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
3	151.101.129.44 151.101.129.44	54113 (FASTLY) (FASTLY)
8	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
4	107.178.244.119 107.178.244.119	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
2 13	216.58.212.130 216.58.212.130	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
2 2	185.33.220.145 185.33.220.145	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c1b::9c	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	185.29.132.242 185.29.132.242	30419 (MEDIAMATH...) (MEDIAMATH-INC)
10	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
4	94.130.102.164 94.130.102.164	24940 (HETZNER-AS) (HETZNER-AS)
1	184.30.20.207 184.30.20.207	16625 (AKAMAI-AS) (AKAMAI-AS)
3	78.46.90.238 78.46.90.238	24940 (HETZNER-AS) (HETZNER-AS)
1 2	23.79.145.223 23.79.145.223	16625 (AKAMAI-AS) (AKAMAI-AS)
3	192.229.220.129 192.229.220.129	15133 (EDGECAST) (EDGECAST)
1 4	95.131.136.1 95.131.136.1	47841 (OXALIDE) (OXALIDE)
2	85.14.248.91 85.14.248.91	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2	46.236.13.147 46.236.13.147	12703 (PULSANT-AS) (PULSANT-AS)
1 2	216.58.212.166 216.58.212.166	15169 (GOOGLE) (GOOGLE)
1 2	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
1 1	3.124.136.236 3.124.136.236	16509 (AMAZON-02) (AMAZON-02)
2 3	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
3 3	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2600:1f18:445... 2600:1f18:445b:903:f033:2332:bd20:fe7f	14618 (AMAZON-AES) (AMAZON-AES)
1	143.204.98.127 143.204.98.127	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80a::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:5f::9	15169 (GOOGLE) (GOOGLE)
1 1	52.18.11.109 52.18.11.109	16509 (AMAZON-02) (AMAZON-02)
2 2	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
4	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
2	54.75.239.54 54.75.239.54	16509 (AMAZON-02) (AMAZON-02)
177	44

2 107.154.139.143 (United States) 2 redirects

ASN19551 (INCAPSULA, US)
PTR: 107.154.139.143.ip.incapdns.net

save70.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 107.154.142.143 (United States)

ASN19551 (INCAPSULA, US)
PTR: 107.154.142.143.ip.incapdns.net

www.save70.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

52 2600:9000:2156:e00:1:c9ba:9380:21 (United States)

ASN16509 (AMAZON-02, US)

d265rl6yp58lzi.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.129.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 107.178.244.119 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 119.244.178.107.bc.googleusercontent.com

pixel.sojern.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 216.58.212.130 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

fcmatch.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fcmatch.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.220.145 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.40.198 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1b::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.29.132.242 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)

tags.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 94.130.102.164 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.164.102.130.94.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.20.207 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-207.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 78.46.90.238 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.238.90.46.78.clients.your-server.de

hal900019.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.79.145.223 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-79-145-223.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.zenaps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.229.220.129 (United States)

ASN15133 (EDGECAST, US)

img.metaffiliation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 95.131.136.1 (France) 1 redirects

ASN47841 (OXALIDE, FR)
PTR: front.netaffiliation.net

action.metaffiliation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 85.14.248.91 (Kamp-Lintfort, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)

m.exactag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.236.13.147 (United Kingdom)

ASN12703 (PULSANT-AS, GB)
PTR: 46-236-13-147.servers.dedipower.net

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.212.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f166.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:f916:5049:f87f:108e (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.136.236 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-136-236.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.190.78 (United Kingdom) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.138 (Frankfurt am Main, Germany) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:445b:903:f033:2332:bd20:fe7f (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.127 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-127.fra50.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80a::2003 (United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:5f::9 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

rr4---sn-4g5e6nsz.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.11.109 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-11-109.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.252.103 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

trc-events.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.75.239.54 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-75-239-54.eu-west-1.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
52	cloudfront.net d265rl6yp58lzi.cloudfront.net	1 MB
24	doubleclick.net 3 redirects googleads.g.doubleclick.net cm.g.doubleclick.net stats.g.doubleclick.net 5994599.fls.doubleclick.net	59 KB
20	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	331 KB
8	google.com 1 redirects www.google.com fcmatch.google.com adservice.google.com	2 KB
8	gstatic.com fonts.gstatic.com www.gstatic.com csi.gstatic.com	140 KB
7	metaffiliation.com 1 redirects img.metaffiliation.com action.metaffiliation.com	47 KB
7	redintelligence.net hal9000.redintelligence.net hal900019.redintelligence.net	54 KB
7	taboola.com cdn.taboola.com trc.taboola.com trc-events.taboola.com	28 KB
5	save70.com 2 redirects save70.com www.save70.com	43 KB
4	mathtag.com tags.mathtag.com pixel.mathtag.com	3 KB
4	google.de www.google.de adservice.google.de	1 KB
4	sojern.com pixel.sojern.com	2 KB
3	webgains.io analytics.webgains.io api.webgains.io	51 KB
3	pubmatic.com 3 redirects image6.pubmatic.com	1 KB
3	rlcdn.com 2 redirects id.rlcdn.com	1 KB
3	bing.com bat.bing.com	11 KB
3	googleadservices.com www.googleadservices.com partner.googleadservices.com	32 KB
3	googleapis.com fonts.googleapis.com	2 KB
2	openx.net 2 redirects rtb.openx.net	581 B
2	rubiconproject.com 2 redirects pixel.rubiconproject.com	920 B
2	quantserve.com 1 redirects cms.quantserve.com	798 B
2	webgains.com track.webgains.com	2 KB
2	exactag.com m.exactag.com	2 KB
2	googletagservices.com www.googletagservices.com	73 KB
2	facebook.com www.facebook.com	386 B
2	adsrvr.org 2 redirects match.adsrvr.org	1015 B
2	adnxs.com 2 redirects ib.adnxs.com	2 KB
2	google-analytics.com www.google-analytics.com	20 KB
2	facebook.net connect.facebook.net	113 KB
2	googletagmanager.com www.googletagmanager.com	86 KB
1	everesttech.net 1 redirects pixel.everesttech.net	375 B
1	googlevideo.com rr4---sn-4g5e6nsz.googlevideo.com	577 KB
1	innovid.com ag.innovid.com	297 B
1	agkn.com 1 redirects d.agkn.com	759 B
1	zenaps.com www.zenaps.com	704 B
1	awin1.com 1 redirects www.awin1.com	722 B
1	youtube.com fcmatch.youtube.com	244 B
177	37

	Domain	Requested by
52	d265rl6yp58lzi.cloudfront.net	www.save70.com d265rl6yp58lzi.cloudfront.net
13	cm.g.doubleclick.net	2 redirects googleads.g.doubleclick.net
10	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
10	pagead2.googlesyndication.com	www.save70.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
8	googleads.g.doubleclick.net	www.googleadservices.com pagead2.googlesyndication.com googleads.g.doubleclick.net
5	www.google.com	www.save70.com googleads.g.doubleclick.net tpc.googlesyndication.com
4	trc-events.taboola.com	cdn.taboola.com
4	action.metaffiliation.com	1 redirects hal900019.redintelligence.net img.metaffiliation.com
4	hal9000.redintelligence.net	www.save70.com hal900019.redintelligence.net
4	pixel.sojern.com	www.save70.com
3	www.gstatic.com	googleads.g.doubleclick.net
3	image6.pubmatic.com	3 redirects
3	id.rlcdn.com	2 redirects googleads.g.doubleclick.net
3	img.metaffiliation.com	hal900019.redintelligence.net img.metaffiliation.com
3	hal900019.redintelligence.net	hal9000.redintelligence.net googleads.g.doubleclick.net hal900019.redintelligence.net
3	tags.mathtag.com	googleads.g.doubleclick.net tags.mathtag.com
3	www.google.de	www.save70.com
3	fonts.gstatic.com	fonts.googleapis.com
3	bat.bing.com	www.save70.com bat.bing.com
3	fonts.googleapis.com	www.save70.com hal900019.redintelligence.net googleads.g.doubleclick.net
3	www.save70.com	www.save70.com
2	api.webgains.io	analytics.webgains.io
2	rtb.openx.net	2 redirects
2	csi.gstatic.com	www.gstatic.com
2	pixel.rubiconproject.com	2 redirects
2	cms.quantserve.com	1 redirects googleads.g.doubleclick.net
2	5994599.fls.doubleclick.net	1 redirects googleads.g.doubleclick.net
2	track.webgains.com	googleads.g.doubleclick.net
2	m.exactag.com	googleads.g.doubleclick.net
2	www.googletagservices.com	googleads.g.doubleclick.net
2	www.facebook.com	www.save70.com
2	adservice.google.com	pagead2.googlesyndication.com 5994599.fls.doubleclick.net
2	match.adsrvr.org	2 redirects
2	ib.adnxs.com	2 redirects
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	trc.taboola.com	cdn.taboola.com
2	connect.facebook.net	www.save70.com connect.facebook.net
2	www.googleadservices.com	www.save70.com www.googletagmanager.com
2	www.googletagmanager.com	www.save70.com
2	save70.com	2 redirects
1	pixel.everesttech.net	1 redirects
1	rr4---sn-4g5e6nsz.googlevideo.com	googleads.g.doubleclick.net
1	analytics.webgains.io	track.webgains.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	d.agkn.com	1 redirects
1	www.zenaps.com	hal900019.redintelligence.net
1	www.awin1.com	1 redirects
1	pixel.mathtag.com	tags.mathtag.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	fcmatch.youtube.com	www.save70.com
1	fcmatch.google.com	1 redirects
1	cdn.taboola.com	www.save70.com
177	54

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
www.top-cruise-deals.com

Subject Issuer	Validity	Valid
imperva.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-09-06` - `2022-03-08`	6 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-09-02` - `2021-12-01`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2021-09-30` - `2022-03-30`	6 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
*.sojern.com DigiCert TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-20`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.mathtag.com DigiCert SHA2 Secure Server CA	`2020-04-15` - `2022-04-22`	2 years	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
redintelligence.net R3	`2021-10-21` - `2022-01-19`	3 months	crt.sh
pixel.mathtag.com DigiCert SHA2 Secure Server CA	`2021-06-29` - `2022-07-07`	a year	crt.sh
www.awin1.com DigiCert SHA2 Secure Server CA	`2021-06-11` - `2022-06-16`	a year	crt.sh
img.metaffiliation.com Gandi Standard SSL CA 2	`2020-12-09` - `2022-01-02`	a year	crt.sh
*.metaffiliation.com Gandi Standard SSL CA 2	`2021-03-08` - `2022-03-20`	a year	crt.sh
*.webgains.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-20` - `2022-06-20`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
*.webgains.io Amazon	`2021-03-12` - `2022-04-10`	a year	crt.sh
*.c.docs.google.com GTS CA 1C3	`2021-11-09` - `2022-01-18`	2 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
*.exactag.com Sectigo RSA Organization Validation Secure Server CA	`2020-01-22` - `2022-04-21`	2 years	crt.sh

This page contains 14 frames:

Primary Page: https://www.save70.com/
Frame ID: B847565F0CAD339D6E9CB059716A9172
Requests: 100 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html
Frame ID: 84514197B248E20EC496EB96BF38401E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=8489995635&adk=3434802048&adf=3656457494&pi=t.ma~as.8489995635&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579183&bpp=4&bdt=270&idt=112&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=8687902763839&frm=20&pv=2&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClepEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZfWoh0Xf5f&p=https%3A//www.save70.com&dtd=133
Frame ID: CEC2EE75FE12DC91E50E14AA7881A755
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=5536529239&adk=744374605&adf=3700167759&pi=t.ma~as.5536529239&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579187&bpp=1&bdt=274&idt=136&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=8687902763839&frm=20&pv=1&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1100&ady=1145&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=NXrK5Vwp92&p=https%3A//www.save70.com&dtd=139
Frame ID: E24395EAC4A03629897A3526F5AFBDCA
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&adk=1812271804&adf=3025194257&lmt=1637754579&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.save70.com%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579196&bpp=1&bdt=283&idt=135&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250%2C300x250&nras=1&correlator=8687902763839&frm=20&pv=1&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=138
Frame ID: 085BECE48A50252017E991351E736481
Requests: 1 HTTP requests in this frame

Frame: https://www.zenaps.com/cshow.php?pvr=9b3de2b0-4d1c-11ec-9d39-2236c0dc0c5d&v=16160&r=296283&q=356171&s=2329635&viewref=42655700085917500951393011788019&pv=1
Frame ID: B3892555E1FF2639386644D5B3BA2F88
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=COrB65_3sPQCFU8eBgAdaysEwg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237
Frame ID: 4750539C030D81825A03F3E8DD166039
Requests: 2 HTTP requests in this frame

Frame: https://hal900019.redintelligence.net/request_content.php?s=42655700085917500951393011788019&a=e05e8d31
Frame ID: EF98E7FFA336CB3A2D8226FC95D8D11A
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6DA3A10E288AB584DCBA5B2EA562BB1D
Requests: 9 HTTP requests in this frame

Frame: https://img.metaffiliation.com/kwanko-sdk-iframe.html
Frame ID: 72C671A7554132A39B6780CC3B176173
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: A0AB3394FD71C14B6A024EC92C7695F0
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js
Frame ID: D5B3B2575F234C920E3D4D55F642426E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 682F3FBDF78588A9797CCCFDBA4CA517
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: F2EEF98E3D49A5A81C7071C008FBCD94
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Save 70

Page URL History Show full URLs

http://save70.com/ HTTP 308
https://save70.com/ HTTP 308
https://www.save70.com/ Page URL

Page Statistics

177
Requests

91 %
HTTPS

45 %
IPv6

37
Domains

54
Subdomains

44
IPs

7
Countries

2908 kB
Transfer

5091 kB
Size

49
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/save70travel

Search URL Search Domain Scan URL

URL: http://www.top-cruise-deals.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://save70.com/ HTTP 308
https://save70.com/ HTTP 308
https://www.save70.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 76

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=WnrJaSkpQ_SWWmBT1KYssg&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj HTTP 302
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj&google_gid=CAESEPPSjMkEqmBvgNBG0hwfOzg&google_cver=1

Request Chain 77

https://cm.g.doubleclick.net/pixel?google_hm=WnrJaSkpQ_SWWmBT1KYssg&google_nid=sojern_adh HTTP 302
https://fcmatch.google.com/pixel?google_gm=AMnCDoqM2XOcbl-hvS3E9_fBeVP1npr1HlC9G6Ljd21se3hAHcv4Th3y_tnWLz3lG94mdsLic9J3LFSQ0tQxDakO3aReXBiFmxe9Jw2sQPdhOSQVp6k6ADw HTTP 302
https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqM2XOcbl-hvS3E9_fBeVP1npr1HlC9G6Ljd21se3hAHcv4Th3y_tnWLz3lG94mdsLic9J3LFSQ0tQxDakO3aReXBiFmxe9Jw2sQPdhOSQVp6k6ADw

Request Chain 78

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fpixel.sojern.com%2Fidsync%2Fapn%3Fid%3D%24UID%26sjrn_id%3DzRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj HTTP 302
https://pixel.sojern.com/idsync/apn?id=3578895244101527089&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj

Request Chain 79

https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=ombl9hp&ttd_puid=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj&ttd_tpi=1 HTTP 302
https://pixel.sojern.com/idsync/ttd?id=4c7d56d2-689a-4c1b-ae17-95ab8021b9a6&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj

Request Chain 105

https://www.awin1.com/cshow.php?s=2329635&v=16160&q=356171&r=296283&pref1=42655700085917500951393011788019&pv=1 HTTP 302
https://www.zenaps.com/cshow.php?pvr=9b3de2b0-4d1c-11ec-9d39-2236c0dc0c5d&v=16160&r=296283&q=356171&s=2329635&viewref=42655700085917500951393011788019&pv=1

Request Chain 108

https://action.metaffiliation.com/trk.php?mann=P511E19571C9F151&argsite=42655700085917500951393011788019&gdprconsent=li HTTP 302
https://m.exactag.com/ai.aspx?extProvId=8&extPu=esprit-dcm&extLi=25444971&extPm=319075961&extCr=&rnd=%n&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_312}

Request Chain 110

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=COrB65_3sPQCFU8eBgAdaysEwg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237

Request Chain 120

https://d.agkn.com/pixel/2175/?google_gid=CAESEJtpmtp15172e_KNmzrQQxc&google_cver=1&google_push=AYg5qPJn37uec2ruRleGXofU-PCdK4WWEw_m-fsTfu9UBoMM5HSxnfJVbqG_WBQlvMEe3li7jDyDNwLQ4Qs14gMWrBXZHvllvUZX HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJn37uec2ruRleGXofU-PCdK4WWEw_m-fsTfu9UBoMM5HSxnfJVbqG_WBQlvMEe3li7jDyDNwLQ4Qs14gMWrBXZHvllvUZX&google_hm=Q0FFU0VKdHBtdHAxNTE3MmVfS05tenJRUXhj

Request Chain 121

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPI_L0m2o12koi6ct3PGxX3rRk4Uo00RQWOlfs-1oiPvQ66W18ie7ZfHtp1WfNGPQqvfR8r0cIgBl3UDQHUlgDERV_1kppdn&google_gid=CAESEPmaMAbRgnwj2Foi2VTeEk0&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCNTN-IwGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBJX0wwbTJvMTJrb2k2Y3QzUEd4WDNyUms0VW8wMFJRV09sZnMtMW9pUHZRNjZXMThpZTdaZkh0cDFXZk5HUFFxdmZSOHIwY0lnQmwzVURRSFVsZ0RFUlZfMWtwcGRu HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQ0s5YWRUbnI0U0tEQ0lGeGQ1VWwxcXZRNXF3bUt6TmJXTnVaLTJCZ2FYMA==&google_push

Request Chain 122

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEG2CfEYXeGMvE5q44Ix9tcE&google_cver=1&google_push=AYg5qPKeAcgXMEm4NzzzbnGEnZTGb-oxEI9ycFJNsFCSBVns4UvVzi8HQdoMzMI6B3MddkKr-xhkPwtLoJKw7YseW3NC2krVVYA HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEG2CfEYXeGMvE5q44Ix9tcE&google_cver=1&google_push=AYg5qPKeAcgXMEm4NzzzbnGEnZTGb-oxEI9ycFJNsFCSBVns4UvVzi8HQdoMzMI6B3MddkKr-xhkPwtLoJKw7YseW3NC2krVVYA&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mYR_0lxkSSGHfzG-Mtu8bQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKeAcgXMEm4NzzzbnGEnZTGb-oxEI9ycFJNsFCSBVns4UvVzi8HQdoMzMI6B3MddkKr-xhkPwtLoJKw7YseW3NC2krVVYA

Request Chain 123

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEItMzUY5wjXQAA4L4nddjs8&google_cver=1&google_push=AYg5qPLnJginBBGKj7FO_FpJs7S6Pjh1htNLx6XLqz506cPkeQYN5q8zBgCN2wklIpI7Ry_vYaWJNW-biWGAjWtDr9yeZpw06L4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dER1NIUlYtMU4tQzk3Rw==&google_push=AYg5qPLnJginBBGKj7FO_FpJs7S6Pjh1htNLx6XLqz506cPkeQYN5q8zBgCN2wklIpI7Ry_vYaWJNW-biWGAjWtDr9yeZpw06L4

Request Chain 124

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_cver=1&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY

Request Chain 151

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMIM-oDCHogYor0HtRSlkS4&google_cver=1&google_push=AYg5qPJo175omUlWE7bv5U1e4bQbeL1wl0FFzEj83x1BO97BkzFKNo1gZPWMpVPbEg6Ty4F_KEdZvIgxjxugjyvDRgV4zQF7gVw HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJo175omUlWE7bv5U1e4bQbeL1wl0FFzEj83x1BO97BkzFKNo1gZPWMpVPbEg6Ty4F_KEdZvIgxjxugjyvDRgV4zQF7gVw&google_hm=XxgKk1ofwRGACKNyB8ugsA

Request Chain 152

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJokkJwKcMu4cEojBHh58WC1M9EqTyKor4BaU9ZKTmPf8z-ToOLTDbWwCZt5yePSVCix7RSpLROLSC8jP3v6e5ytEZAd34&google_gid=CAESEBG_h3uT4poahIiHvbIR448&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVo0bTFBQUFCSTlZM2tyLQ&google_push=AYg5qPJokkJwKcMu4cEojBHh58WC1M9EqTyKor4BaU9ZKTmPf8z-ToOLTDbWwCZt5yePSVCix7RSpLROLSC8jP3v6e5ytEZAd34

Request Chain 154

https://rtb.openx.net/sync/dds?google_gid=CAESEPxyKH1_1I2F-TVkxTrYzZk&google_cver=1&google_push=AYg5qPITp3s3Oj-FxJfSp4-BpTfCvzkKBPji9yYRnb3pmA_gZnMjv22tYtlcediBAEIBfiUabD_uOakOmOJLX4BwUWQGeNMd8B8 HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEPxyKH1_1I2F-TVkxTrYzZk&google_cver=1&google_push=AYg5qPITp3s3Oj-FxJfSp4-BpTfCvzkKBPji9yYRnb3pmA_gZnMjv22tYtlcediBAEIBfiUabD_uOakOmOJLX4BwUWQGeNMd8B8&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPITp3s3Oj-FxJfSp4-BpTfCvzkKBPji9yYRnb3pmA_gZnMjv22tYtlcediBAEIBfiUabD_uOakOmOJLX4BwUWQGeNMd8B8&google_hm=81J-2TQgx3E2l1gLPz5lbQ==

Request Chain 155

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEClJpSZ5qEep6IQSXi3IDSY&google_cver=1&google_push=AYg5qPKYqTfTRJNsWHTC-_zETIFGnZm_jRgsLdDJmba5bU2Ibvg2spzctg7aJwFpyFZfVUjHJ2ji73ga3X0Jp8cMGHTQU8rkZjE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mYR_0lxkSSGHfzG-Mtu8bQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKYqTfTRJNsWHTC-_zETIFGnZm_jRgsLdDJmba5bU2Ibvg2spzctg7aJwFpyFZfVUjHJ2ji73ga3X0Jp8cMGHTQU8rkZjE

Request Chain 156

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFwqoBNMo622rLNdR2BoovY&google_cver=1&google_push=AYg5qPJQCUKk0cisV070Q1K9wL24hSdCyIXB6NwAz2aAwve2cIXVjJTEANqF5AMJV_bqmra_uDHJGrdySaCi9Sh2DRLf0mOg-KE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dER1NJMkgtMUEtTDNKWQ==&google_push=AYg5qPJQCUKk0cisV070Q1K9wL24hSdCyIXB6NwAz2aAwve2cIXVjJTEANqF5AMJV_bqmra_uDHJGrdySaCi9Sh2DRLf0mOg-KE

Request Chain 157

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc

177 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.save70.com/
Redirect Chain

http://save70.com/
https://save70.com/
https://www.save70.com/

133 KB
21 KB

409ms
370ms

Document
text/html

107.154.142.143
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.142.143 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.142.143.ip.incapdns.net
Software: nginx /
Resource Hash: 0004f78c83a4872b4cd2445955afbe9532286d70acab9b7f7f2b2b5e0559b4c4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
date: Wed, 24 Nov 2021 11:49:38 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
expires: Fri, 26 Nov 2021 11:49:38 GMT
cache-control: max-age=172800
pragma: no-cache
content-encoding: gzip
x-cdn: Imperva
x-iinfo: 4-84743463-84743464 NNNN CT(92 89 0) RT(1637754578113 0) q(0 0 1 0) r(2 3) U5

Redirect headers

server: nginx
date: Wed, 24 Nov 2021 11:49:38 GMT
content-type: text/html
content-length: 164
location: https://www.save70.com/
x-cdn: Imperva
x-iinfo: 14-129648454-129648455 NNNN CT(1 3 0) RT(1637754578379 0) q(0 0 0 -1) r(0 0) U5

GET
H2 200 css
fonts.googleapis.com/ 2 KB
981 B 38ms
15ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Ubuntu&subset=cyrillic,latin

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

eda144dea7a719010fe6c2e87514f5eca490b3c74f120f6ac8cb514596d4ef48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 11:33:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Nov 2021 11:49:38 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Nov 2021 11:49:38 GMT

GET
H2 200 style.css
d265rl6yp58lzi.cloudfront.net/find/css/ 39 KB
6 KB 35ms
8ms Stylesheet
text/css 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e2bbfe4e8a5fc063c6da3f10a155756faa5c44a1ec731c0588a745ed2f468bde

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 12-73360497-73360498 NNNN CT(89 117 0) RT(1636470293317 2) q(0 0 2 0) r(3 3) U5
last-modified: Wed, 10 Jul 2019 05:24:02 GMT
server: nginx
etag: W/"5d257672-9cd9"
vary: Accept-Encoding
content-type: text/css
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: v5t2hokXt5KZljXaMAdbo0IuQaNiKDyvVxU2IGJYeEzbeL4yaCmWdw==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 bootstrap.css
d265rl6yp58lzi.cloudfront.net/find/assets/bootstrap/ 4 KB
1 KB 48ms
21ms Stylesheet
text/css 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/assets/bootstrap/bootstrap.css
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 40c86ac6b4d6e23507014e7f39b7a71bc54f256e1fab9154bbc522e8a0591e8a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 6-39765449-39765451 NNNN CT(90 104 0) RT(1636470293535 4) q(0 0 2 0) r(3 3) U5
last-modified: Sun, 07 Aug 2016 14:02:34 GMT
server: nginx
etag: W/"57a73f7a-110f"
vary: Accept-Encoding
content-type: text/css
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: w3FFWZA1SpZ0wo9gU-eaEbZzMarVNM9dp3gj1PIeYViMVcOLOZsl1w==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 jquery-ui-1.10.3.custom.min.css
d265rl6yp58lzi.cloudfront.net/assets/jquery-ui/css/smoothness/ 23 KB
5 KB 35ms
9ms Stylesheet
text/css 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/assets/jquery-ui/css/smoothness/jquery-ui-1.10.3.custom.min.css
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: db001a2e32ab0dc68668d00818a35b967c336b27030a25a1852ba8db71ed52fd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 14-184556052-184556053 NNNN CT(93 97 0) RT(1636470293314 3) q(0 0 2 0) r(2 2) U5
last-modified: Wed, 14 Sep 2016 13:58:45 GMT
server: nginx
etag: W/"57d95795-5cb4"
vary: Accept-Encoding
content-type: text/css
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: TCP0AjtcKVL_HjIEssEznvV7_GPB0vTLGvCfwqpdbKVEeiW1jjlTSg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 jquery-ui.css
d265rl6yp58lzi.cloudfront.net/assets/jquery.ptTimeSelect/ 33 KB
6 KB 36ms
9ms Stylesheet
text/css 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/assets/jquery.ptTimeSelect/jquery-ui.css
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 9bc808435e97a474ebd234009317f9f5abda4b5c4a853ab153144f1ca455500a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 12-75304951-75304952 NNNN CT(89 99 0) RT(1636470293536 2) q(0 0 2 0) r(3 3) U5
last-modified: Wed, 14 Sep 2016 13:58:46 GMT
server: nginx
etag: W/"57d95796-8426"
vary: Accept-Encoding
content-type: text/css
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 9TZvxybQ0V1FYqLQnIXDHP_Vy-uJba4I7qE2yb9IWigy8pZZqBXWHg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 ads.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/ 48 B
551 B 34ms
8ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/ads.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 70322b0579ed048b8bf9115205b2a6d4d07a46e151b42ac05ff3b6c39aa56077

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 14:59:31 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284607
x-cache: Hit from cloudfront
x-iinfo: 10-69433568-69433570 NNNN CT(86 91 0) RT(1636469970954 5) q(0 0 2 0) r(3 3) U5
last-modified: Sun, 07 Aug 2016 14:02:56 GMT
server: nginx
etag: W/"57a73f90-30"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 1KMMBvam57KVDXVTMtFy99GLE9aVFU-T8hwx-Bp4wHW0NBtH-7v3xQ==
expires: Wed, 09 Nov 2022 14:59:31 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 59ms
21ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-42783156-1

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7114abbd10651728debfda1059bddc13e17c73ca3a0c3607ca5adb048b47fac7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36131
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 24 Nov 2021 11:49:39 GMT

GET
H2 200 logo.png
d265rl6yp58lzi.cloudfront.net/images/home/ 2 KB
3 KB 26ms
21ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/logo.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e70462e35d7e0c5ae0b1a28034d698f29a6ab869e21600c7aa1ffa2942863e43

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 14:59:32 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284606
x-cache: Hit from cloudfront
x-iinfo: 10-69433636-69433637 NNNN CT(88 88 0) RT(1636469971412 2) q(0 0 1 0) r(2 2) U5
content-length: 2120
last-modified: Thu, 12 Jan 2017 10:28:28 GMT
server: nginx
etag: "58775a4c-848"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 8PdqdysX716DmXeFtlzJ0F2KfcupO7j9_kStnKdQCuTeL46bbrc0_w==
expires: Wed, 09 Nov 2022 14:59:32 GMT

GET
H2 200 logo-no-slogan.jpg
d265rl6yp58lzi.cloudfront.net/images/home/ 3 KB
3 KB 31ms
26ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/logo-no-slogan.jpg
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 7b222cca01cef205d7ea1a27602f4d3fb3b5a32f3c2c750775d88baf3c66bc96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 14:59:32 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284606
x-cache: Hit from cloudfront
x-iinfo: 13-118093425-118093427 NNNN CT(88 90 0) RT(1636469971641 2) q(0 0 2 0) r(3 3) U5
content-length: 3096
last-modified: Thu, 09 Feb 2017 10:30:58 GMT
server: nginx
etag: "589c44e2-c18"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: wTCTN4xVBSG6QA2xR9UTp90wzZr6gCNKk-bHJB5hpf25y7qtTE8o_w==
expires: Wed, 09 Nov 2022 14:59:32 GMT

GET
H2 200 cookieconsentrio.min.css
d265rl6yp58lzi.cloudfront.net/find/cookie/ 6 KB
2 KB 7ms
7ms Stylesheet
text/css 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/cookie/cookieconsentrio.min.css
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6c0dc52517171f5b3f722b563cdd6d3635b0422a4e67f35719869879d0061c32

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 14:59:32 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284606
x-cache: Hit from cloudfront
x-iinfo: 9-36032641-36032644 NNNN CT(89 99 0) RT(1636469971501 7) q(0 0 1 1) r(2 2) U5
last-modified: Wed, 21 Nov 2018 10:56:33 GMT
server: nginx
etag: W/"5bf539e1-16f4"
vary: Accept-Encoding
content-type: text/css
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: NFrMm_AMEPm3x1I-U4KIcpGphKWV04lx7-QdsXrkJf3EqvniKXZF-w==
expires: Wed, 09 Nov 2022 14:59:32 GMT

GET
H2 200 cookieconsent.min.js Show response
d265rl6yp58lzi.cloudfront.net/find/cookie/ 19 KB
7 KB 11ms
11ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/cookie/cookieconsent.min.js
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 14:59:32 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284606
x-cache: Hit from cloudfront
x-iinfo: 14-109537288-109537290 NNNN CT(86 89 0) RT(1636469971591 3) q(0 1 2 8) r(3 3) U5
last-modified: Tue, 09 Jan 2018 13:23:56 GMT
server: nginx
etag: W/"5a54c26c-4d5a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: zjQovlxvPlIcXXSNhKj0q5LAiPadCXdnHYRS_qgUrtYHBgxDvWFfAg==
expires: Wed, 09 Nov 2022 14:59:32 GMT

GET
H2 200 hamburger.png
d265rl6yp58lzi.cloudfront.net/images/ 124 B
562 B 26ms
21ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/hamburger.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 02ccfd89151b3defcfac407ee8ceb1ba647ff915a9aa2a88edf8129d3b53f549

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 14:59:32 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284606
x-cache: Hit from cloudfront
x-iinfo: 11-99831952-99826815 PNNN RT(1636469971412 2) q(0 0 0 1) r(1 1) U5
content-length: 124
last-modified: Sun, 07 Aug 2016 14:04:28 GMT
server: nginx
etag: "57a73fec-7c"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: eDoJ-jLeIGnL60tZUZL6MRJa5UNFwTQaOfv4I37RQfZq56cij69EWw==
expires: Wed, 09 Nov 2022 14:59:32 GMT

GET
H2 200 menu_icon_flight.png
d265rl6yp58lzi.cloudfront.net/images/home/ 688 B
1 KB 30ms
26ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/menu_icon_flight.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 17ea292a2ef40111675528e938e0cd6972dcb96bcb889de5f265c37045a4c265

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 9-47943040-47943041 NNNY CT(192 90 0) RT(1636470293686 2) q(0 0 0 0) r(0 1) U5
content-length: 688
last-modified: Sun, 07 Aug 2016 14:04:40 GMT
server: nginx
etag: "57a73ff8-2b0"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: J3LcQGa6UZrBGFD5MkYzqzJbEgrEngnW7i75jeKmK9ak0y9TrZ4BKg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 menu_icon_hotels.png
d265rl6yp58lzi.cloudfront.net/images/home/ 531 B
980 B 31ms
27ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/menu_icon_hotels.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 70f0d86ab28486e9e39dab60185fccccff184e1da526a1f655d2c02b04cada3e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 14 Nov 2021 00:37:59 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 904299
x-cache: Hit from cloudfront
x-iinfo: 10-104820616-104820617 NNNN CT(87 89 0) RT(1636850278605 5) q(0 0 1 1) r(2 2) U5
content-length: 531
last-modified: Sun, 07 Aug 2016 14:04:40 GMT
server: nginx
etag: "57a73ff8-213"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: Sip8pPe1q2rZk4jVQ2KaW4HY_YXwP6VGzIiS1ReS0wQthXG2x35daA==
expires: Mon, 14 Nov 2022 00:37:59 GMT

GET
H2 200 menu_icon_cruises.png
d265rl6yp58lzi.cloudfront.net/images/home/ 950 B
1 KB 31ms
26ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/menu_icon_cruises.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: c43aae53c7c481a2d3d74653d8869a572377c16dc821cfff277f242609e6c9d5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 11-99900884-99900886 NNNN CT(89 101 0) RT(1636470293690 2) q(0 0 2 0) r(3 3) U5
content-length: 950
last-modified: Sun, 07 Aug 2016 14:04:40 GMT
server: nginx
etag: "57a73ff8-3b6"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: YesCp5Mz9y9a8AgVu0c_e0werrxVf9DSYaQOzxzeFlmgRiUrW5AZhg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 menu_icon_car.png
d265rl6yp58lzi.cloudfront.net/images/home/ 943 B
1 KB 31ms
27ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/menu_icon_car.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: bc71a31e151ac976050a16caa9b4115f0285a004363dba9b9684c0b10a631b0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 10-26779591-26779592 NNNN CT(86 88 0) RT(1636470293686 3) q(0 0 2 0) r(3 3) U5
content-length: 943
last-modified: Sun, 07 Aug 2016 14:04:39 GMT
server: nginx
etag: "57a73ff7-3af"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: q3kyUmnYXhJqDAfEantwalzKjAqEhimHLkJyUsMgasswF1ve7y1W7w==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 143 KB
51 KB 66ms
29ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4363b79dbb4640d36745601deffc98c914f7e56fb2a83a66c652c987dd6cd03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51207
x-xss-protection: 0
server: cafe
etag: 13054855517399431562
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 24 Nov 2021 11:49:39 GMT

GET
H2 200 Mountain-Biking.jpg
d265rl6yp58lzi.cloudfront.net/images/home/ 23 KB
23 KB 31ms
27ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/Mountain-Biking.jpg
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ff448cd042c9b87c9ff4f2c1168f5f1d56d11aecf0de7621695923cd2da3f187

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 8-5877666-5877667 NNNY CT(87 116 0) RT(1636470293685 2) q(0 0 0 0) r(0 2) U5
content-length: 23349
last-modified: Sun, 07 Aug 2016 14:04:30 GMT
server: nginx
etag: "57a73fee-5b35"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: T0xrObNymDSUQ0zIJ04XjLIiEKrYxv6AZWcNza9EbI_W13dNZ5FvoA==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 turkey.jpg
d265rl6yp58lzi.cloudfront.net/images/home/ 40 KB
41 KB 51ms
47ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/turkey.jpg
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 281434186f02e4d8317bb94c8f374f56436b6ce187aab1a365f8572b948cae3b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 10-69486971-69486973 NNNN CT(91 86 0) RT(1636470293695 2) q(0 0 2 0) r(3 4) U5
content-length: 41255
last-modified: Sun, 07 Aug 2016 14:04:45 GMT
server: nginx
etag: "57a73ffd-a127"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: US161jWzpbIwIj3PStaVvYILHQURUPwr9aGT43zCFS5yMTe90agP3g==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 Japan.jpg
d265rl6yp58lzi.cloudfront.net/images/home/ 79 KB
80 KB 41ms
37ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/Japan.jpg
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ab3eaca8dd9c19432ada4e805811176d0a474621b3506ab4b2acd91709e6c1bb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 10-26779589-26779590 NNNY CT(89 115 0) RT(1636470293681 2) q(0 0 0 0) r(0 2) U5
content-length: 81059
last-modified: Sun, 07 Aug 2016 14:04:29 GMT
server: nginx
etag: "57a73fed-13ca3"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: HOz9l-rBknCBziC71gXnBiT53mOGF4_u_e2afQ_omFDhsukwe_Cksw==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 Amsterdam-Canal.jpg
d265rl6yp58lzi.cloudfront.net/images/destinations/ 110 KB
110 KB 45ms
41ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/destinations/Amsterdam-Canal.jpg
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 11a82ab5c0b6b2513628cbb8231cab20436c04825530639eac8a9b0af1f8b5bd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 11-46608248-46608251 NNNN CT(88 89 0) RT(1636470293688 3) q(0 0 2 0) r(3 4) U5
content-length: 112577
last-modified: Sun, 07 Aug 2016 14:04:23 GMT
server: nginx
etag: "57a73fe7-1b7c1"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: BGReNdtTISGtUFGW9UyuqIiGI1Jm0CKJI5QLNCE8EHuFVIuPRSpmnA==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 Azores-Terra-Nostra-Garden.jpg
d265rl6yp58lzi.cloudfront.net/images/destinations/ 188 KB
189 KB 31ms
27ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/destinations/Azores-Terra-Nostra-Garden.jpg
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 126e39056f0841be1e0d8764bfc456458b05e1b2c2cd1e04ab1fd3bb4d57aaa6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 12-73360553-73360554 NNNN CT(87 88 0) RT(1636470293689 2) q(0 0 2 0) r(3 4) U5
content-length: 192532
last-modified: Sun, 07 Aug 2016 14:04:23 GMT
server: nginx
etag: "57a73fe7-2f014"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: F67-ZZp9ZxZgEHCpw1NUidCuuY-rG6170c14ElmhPSa0Fw0x_LgR2Q==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 Bangkok-from-Above.jpg
d265rl6yp58lzi.cloudfront.net/images/destinations/ 152 KB
153 KB 47ms
44ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/destinations/Bangkok-from-Above.jpg
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 182c9431e1fb414573d47253a9c441ea7742ead6a1bc02ea4606b6cf94a640c1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 14-138693291-138693293 NNNN CT(87 90 0) RT(1636470293693 2) q(0 0 2 0) r(3 4) U5
content-length: 155599
last-modified: Sun, 07 Aug 2016 14:04:23 GMT
server: nginx
etag: "57a73fe7-25fcf"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: P50kyWve_LTN-5xewwPTjkRXLrHB_7j9YPSb9R2A4hz_MHN4Ja1SPg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 Floripa-beach.jpg
d265rl6yp58lzi.cloudfront.net/images/destinations/ 128 KB
128 KB 37ms
34ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/destinations/Floripa-beach.jpg
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 62b8ca931da47566664fe3204915e230578d29eece27c17278a45c8e76717874

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 6-39765495-39765496 NNNN CT(90 88 0) RT(1636470293931 2) q(0 0 2 0) r(3 3) U5
content-length: 130983
last-modified: Sun, 07 Aug 2016 14:04:24 GMT
server: nginx
etag: "57a73fe8-1ffa7"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 7aV5g8HY56rHYHJVGIjsvQTPFy61jSVSjsuaLA3WcwdySwU4Gic8_g==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 copenhagen-small-port.jpg
d265rl6yp58lzi.cloudfront.net/images/destinations/ 145 KB
145 KB 52ms
49ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/destinations/copenhagen-small-port.jpg
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: aa9e532a2dfbe0c0e1560869c9579d1912542e51ebb369497a2d09e1bf8bc30b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 7-19656530-19656531 NNNN CT(88 90 0) RT(1636470293704 1) q(0 0 1 0) r(2 3) U5
content-length: 148043
last-modified: Sun, 07 Aug 2016 14:04:24 GMT
server: nginx
etag: "57a73fe8-2424b"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 6RLYvfEQRfuw1n8Agy4eDu_w0QKIYBgeXaY4abmN3F3hfbVQquJovg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 icon_fb.png
d265rl6yp58lzi.cloudfront.net/images/home/ 678 B
1 KB 36ms
33ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/icon_fb.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ee431f76f1af9c4f0ee67efe6267eb86e2cc7b33723c32f5168096c2c1f8e254

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 14:59:32 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284607
x-cache: Hit from cloudfront
x-iinfo: 10-69433568-69433570 SNNN RT(1636469970954 449) q(0 0 0 0) r(0 0) U5
content-length: 678
last-modified: Thu, 12 Jan 2017 10:28:28 GMT
server: nginx
etag: "58775a4c-2a6"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 8_vgJ9mHtoXd0MzJ5gKy3qNvHYXJFSPnKo_fTCWLdv8_ENA31TDJSg==
expires: Wed, 09 Nov 2022 14:59:32 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 45 KB
18 KB 57ms
33ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

4112275fe878d4b037316a449f7516817d3c7da7839eb532b81c80b309b36df5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17627
x-xss-protection: 0
server: cafe
etag: 16294007831590153160
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 24 Nov 2021 11:49:39 GMT

GET
H2 200 jquery-1.10.2.min.js Show response
d265rl6yp58lzi.cloudfront.net/assets/ 91 KB
33 KB 19ms
12ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/assets/jquery-1.10.2.min.js
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 11-99900889-99900890 NNNN CT(86 89 0) RT(1636470293705 1) q(0 0 1 0) r(2 3) U5
last-modified: Sun, 07 Aug 2016 13:42:35 GMT
server: nginx
etag: W/"57a73acb-16bb3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: j6gH6s6NzYgnYISp0EvgaotNQP_uBiXAEdd8khWQIvL-xXy7-vstcQ==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 jquery-ui-1.10.3.custom.min.js Show response
d265rl6yp58lzi.cloudfront.net/assets/ 223 KB
60 KB 21ms
14ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/assets/jquery-ui-1.10.3.custom.min.js
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 087d61da6ab1ca4ff1c5de94d14e964c73a99c9fc6cd7275f556c199e74463ef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 14-184556052-184556053 SNNN RT(1636470293314 368) q(0 0 0 1) r(1 1) U5
last-modified: Sun, 07 Aug 2016 13:43:18 GMT
server: nginx
etag: W/"57a73af6-37b29"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: yfWM2NrfZS8d9yTfto9e9wDyI8idhWfTHn8miYV1Q2Hj_cn7J0Q6Zg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 bootstrap.js Show response
d265rl6yp58lzi.cloudfront.net/find/assets/bootstrap/ 57 KB
11 KB 17ms
11ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/assets/bootstrap/bootstrap.js
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 20f9dc1b8566a371cc3e871516427ca49165c3c5ee486801240fe3e725da235c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 12-75304951-75304952 SNNN RT(1636470293536 367) q(0 0 0 0) r(0 0) U5
last-modified: Sun, 07 Aug 2016 14:02:35 GMT
server: nginx
etag: W/"57a73f7b-e3d7"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: EjEsHlHuHdREPoE0qyR6goAS0DAzgCZcVA7E2c6EJPkTi1yokRFphw==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjs.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/ 10 KB
4 KB 25ms
18ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/tbjs.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b993dfd5baa98286865b515ab8d2b3b68527d9b7422c14d53d815ce97435b4bc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 12-73360548-73360551 NNNY CT(89 114 0) RT(1636470293682 3) q(0 0 0 1) r(0 1) U5
last-modified: Sun, 18 Aug 2019 08:46:51 GMT
server: nginx
etag: W/"5d59107b-2752"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: i3UvyRCWY29H9hw_lzhZcjEVV_n2Q2pFWjj_iXPfQSuHKYGWRNDOJQ==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjsAutocomplete.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/ 12 KB
5 KB 26ms
19ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/tbjsAutocomplete.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: d4f459ac6f8be24990c22bb72a64a017308fd2eb4f1a1ff0d1d0dc6dd9522af0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 12-73360549-73360550 NNNY CT(89 115 0) RT(1636470293682 2) q(0 0 0 0) r(0 1) U5
last-modified: Sun, 03 Jan 2021 09:16:40 GMT
server: nginx
etag: W/"5ff18b78-31af"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 67iwOuJIuN93E9ywI8gL61h8L02tUu_cZpflc3r8U-UIELBxYuCN-g==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjs_save70.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/ 5 KB
2 KB 32ms
26ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/tbjs_save70.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: bc29d7634ee1e158ef977eddad7126bf3e396d8b4c0fa382b395bd942231a51b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 9-36054974-36054975 NNNN CT(90 93 0) RT(1636470293939 3) q(0 0 2 0) r(3 3) U5
last-modified: Sun, 13 Jun 2021 12:59:39 GMT
server: nginx
etag: W/"60c6013b-135d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 0vaQ48iwFL3IOo2voQUfPyRwt1gbjGSbeN8DvHCQ1Knp6IiHVWQ7dA==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjs_adsTracker.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/ 2 KB
1 KB 26ms
19ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/tbjs_adsTracker.js
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: bd9d0b5001d9b64ca2883d3732d50fe11cdb00bd4a94603f23c331d9ca2de245

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 6-39765449-39765451 SNNN RT(1636470293535 369) q(0 0 0 0) r(1 1) U5
last-modified: Sun, 22 Sep 2019 08:52:46 GMT
server: nginx
etag: W/"5d87365e-6f2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: jGDiFEaRbjB49fOYGuOSt5_eturmK7xHlKLk7qgYUJ76rlRV2lRPEg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjs_newsletter.js Show response
d265rl6yp58lzi.cloudfront.net/js/ 59 KB
10 KB 27ms
21ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/js/tbjs_newsletter.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 879f1e66c89ff2411741c6a3c62704f137b8a0595b54d4953ac5caeef5a28fed

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 12-75304993-75304994 NNNY CT(90 190 0) RT(1636470293906 3) q(0 0 0 0) r(0 1) U5
last-modified: Mon, 30 Aug 2021 15:51:34 GMT
server: nginx
etag: W/"612cfe86-ed68"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: LHZLIEHfCahz-D2H6SmQdu1kwoYfTMxMtUseDbT0nXubmahYglk2Uw==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjs_save70_flights_multiple.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/bf/ 30 KB
7 KB 27ms
21ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/bf/tbjs_save70_flights_multiple.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6b983c3c5239cb6e65a69bc5391d5152e5590012170847ec091d679c70968e44

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 12-73360497-73360498 SNNN RT(1636470293317 362) q(0 0 0 0) r(1 1) U5
last-modified: Mon, 30 Aug 2021 15:51:31 GMT
server: nginx
etag: W/"612cfe83-7777"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 5mEJ37zY1ahuTn7_dAavnQjvBSMrGKvrC-6wOdjzh34IKDQRUKeYVQ==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjs_save70_hotels_multiple.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/bf/ 57 KB
8 KB 26ms
20ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/bf/tbjs_save70_hotels_multiple.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0de29f44d21c92de8222cfde8f48acf67877acc4ac93419e5364c5984b8d2fbf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 3-24896443-24896444 NNNN CT(87 86 0) RT(1636470293933 3) q(0 0 2 0) r(2 2) U5
last-modified: Tue, 02 Nov 2021 09:55:59 GMT
server: nginx
etag: W/"61810b2f-e4c3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: YpxReK2w9bl-CeJ9mvrahY-uv5-JyO_mtBjeOUY8-3xQa3TbzaMWLw==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjs_save70_cruises_multiple.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/bf/ 11 KB
3 KB 31ms
25ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/bf/tbjs_save70_cruises_multiple.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a3fcfcba8bd7df8f0e016aae0562086a2268c47e22b7af5d9e7b2eedadfd5559

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 11-46608249-46608252 NNNN CT(87 89 0) RT(1636470293689 3) q(0 0 2 0) r(3 3) U5
last-modified: Mon, 30 Aug 2021 15:51:31 GMT
server: nginx
etag: W/"612cfe83-2b7e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: DiYINtwKJKdiaE81bswWVndUarYuh6ESaQFNtZ5YNQltpPnMNzFe4g==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjs_save70_cars_multiple.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/bf/ 34 KB
7 KB 28ms
22ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/bf/tbjs_save70_cars_multiple.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ea88d35466ce56efd4aefddb9d35e65ff3f98ba89e5c2e840184a8fbff15fa06

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 14-184556153-184556155 NNNN CT(86 96 0) RT(1636470293701 2) q(0 0 1 0) r(2 2) U5
last-modified: Mon, 30 Aug 2021 15:51:30 GMT
server: nginx
etag: W/"612cfe82-8960"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 4bwrpmPnTfd6CRG-7tWfAfamCSpnlZ47M3AQz_zlQAMn7OclrINvsA==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 tbjs_save70_home.js Show response
d265rl6yp58lzi.cloudfront.net/find/js/home/ 6 KB
2 KB 31ms
25ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/js/home/tbjs_save70_home.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e33d9edb33be378790da368306294d2c7b536747487e19e2d137a737dcebc85d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 4-38121804-38121806 NNNN CT(88 91 0) RT(1636470293907 2) q(0 0 1 0) r(2 2) U5
last-modified: Sun, 22 Sep 2019 08:52:45 GMT
server: nginx
etag: W/"5d87365d-17f7"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: cPw6_d16gRKYfyzqn9267nrwo7l-4LR3yeexo6StleUzckZsAF4s2Q==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 megamenu.js Show response
d265rl6yp58lzi.cloudfront.net/find/assets/megamenu/ 1 KB
939 B 27ms
21ms Script
application/javascript 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d265rl6yp58lzi.cloudfront.net/find/assets/megamenu/megamenu.js?250
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: fb9ef39c2d44d48d8cc981141a527e645a6e5b5341093872ada6cd86f18bb0fc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
content-encoding: gzip
x-cdn: Imperva
age: 1284284
x-cache: Hit from cloudfront
x-iinfo: 6-8590128-8590130 NNNN CT(86 88 0) RT(1636470293693 1) q(0 0 2 0) r(3 3) U5
last-modified: Sun, 07 Aug 2016 14:02:36 GMT
server: nginx
etag: W/"57a73f7c-4ee"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: YK2kh_Bi5xsJpa-GJt2TB4DIdCRkMK_ZmOVak0s_uTzqdiDrEWqjjw==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 newsletter-v-button.png
d265rl6yp58lzi.cloudfront.net/images/icons/ 434 B
881 B 44ms
41ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/icons/newsletter-v-button.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: f6d43bae73b7ebfcfdf6608cb5c4cdbece0f7aa052705d4088817c6621e03e03

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 10-69486969-69486970 NNNN CT(93 91 0) RT(1636470293691 2) q(0 0 2 0) r(3 3) U5
content-length: 434
last-modified: Thu, 12 Jan 2017 10:28:29 GMT
server: nginx
etag: "58775a4d-1b2"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: qnmarsmMp9vLA7bMctebJatXpgp0XIUCmfz226nvodpn9tVTSOBwwg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 dealbase-nospam.png
d265rl6yp58lzi.cloudfront.net/images/ 2 KB
2 KB 43ms
40ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/dealbase-nospam.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 07880bac04585b241a57f5826cc3ba254f58a14b5a1704561b11d9ca51f8144a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 11-46608246-46608250 NNNN CT(87 90 0) RT(1636470293687 2) q(0 0 2 0) r(3 3) U5
content-length: 1858
last-modified: Mon, 29 Aug 2016 16:37:38 GMT
server: nginx
etag: "57c464d2-742"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 9R8drpX9gOsJMthfSG-_4zR9ZnKv2THsv9F2rA8elsblFSghjtnAMw==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 dunhillsmall.png
d265rl6yp58lzi.cloudfront.net/images/ 2 KB
3 KB 36ms
34ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/dunhillsmall.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d33406d748b6f24a0cb72ac8ebd1409f87c77ece41164aad43b224d8fb24d9f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 12-75304996-75304997 NNNN CT(94 94 0) RT(1636470293912 2) q(0 0 2 0) r(2 2) U5
content-length: 2276
last-modified: Mon, 29 Aug 2016 16:37:38 GMT
server: nginx
etag: "57c464d2-8e4"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 7hB1SCKsJ2qt6TmpLWRxXnXdlQFpQBWN0oRMqvgl2pJPrgSDMxA8nw==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 checkmark.png
d265rl6yp58lzi.cloudfront.net/images/ 482 B
929 B 46ms
43ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/checkmark.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2da5386d859fb6b2a3c43913dfcae2848fa338d4613e30c56213e93292decebe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 7-19656525-19656529 NNNN CT(89 89 0) RT(1636470293692 2) q(0 0 2 0) r(3 3) U5
content-length: 482
last-modified: Mon, 29 Aug 2016 16:37:38 GMT
server: nginx
etag: "57c464d2-1e2"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: NJ18MJVCH-wpwgMDkVoblG_tB97tTRSNffIKcWQkermSEBaydG9xCg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 noentry.png
d265rl6yp58lzi.cloudfront.net/images/ 359 B
808 B 42ms
39ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/noentry.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 7be52968cd33e197fef54ea18403a04c9e04d4f607e00a4c5eebea4174c5249d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 14-138693294-138693297 NNNN CT(89 90 0) RT(1636470293697 2) q(0 0 2 0) r(3 3) U5
content-length: 359
last-modified: Mon, 29 Aug 2016 16:37:40 GMT
server: nginx
etag: "57c464d4-167"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: a6dlhvAa8koA-U5JMiZh0wHDxiRdoGTjluZW7p4Rvnene-QLZ0w03Q==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 trimmed_cruise_logo.png
d265rl6yp58lzi.cloudfront.net/images/ 4 KB
4 KB 42ms
40ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/trimmed_cruise_logo.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 8be01f8e757eb9e92da087e67908b20e70dafab8fd6969c4e4bd80886d3c3eb1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 11-99900882-99900883 NNNY CT(192 91 0) RT(1636470293684 2) q(0 0 0 0) r(0 1) U5
content-length: 3720
last-modified: Mon, 29 Aug 2016 16:37:41 GMT
server: nginx
etag: "57c464d5-e88"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 5kKTqGb4PJI9czdcAPkZ1blb41ia-GjCzVtpN36XOD1S7R58vAVNEg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 Save70-logo-transparent.png
d265rl6yp58lzi.cloudfront.net/images/ 3 KB
3 KB 43ms
40ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/Save70-logo-transparent.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6b5b394190bf78592909ab9f0c97fcd974cfaaa6090784d86867c519cfadee86

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 7-50550774-50550776 NNNN CT(84 86 0) RT(1636470293915 2) q(0 0 1 0) r(2 2) U5
content-length: 2951
last-modified: Thu, 19 Jul 2018 12:52:24 GMT
server: nginx
etag: "5b508988-b87"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: HVRvjY4wBrbSoahRus2XaRQsWKWW-wVaoh74Wp006oW_8cKuwFNeZA==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 _Incapsula_Resource Show response
www.save70.com/ 152 KB
21 KB 20ms
18ms Script
application/javascript 107.154.142.143
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.save70.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1871149766
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.142.143 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.142.143.ip.incapdns.net
Software: /
Resource Hash: edc16e4f8de2223172e1d6034ceb1254b0749b56e0143c94915bd249c3092045

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-encoding: gzip
cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 21727
content-type: application/javascript

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 25ms
6ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 25965
x-xss-protection: 0
pragma: public
x-fb-debug: qJeq4eqWwve3oOKoZVlKaIswcMtMPZyv+e2U5tl14S/+qIbyEB1pxTYpFb2m+3IuOe/isI39cAl5o1TjOSCZow==
x-fb-trip-id: 917726464
x-frame-options: DENY
date: Wed, 24 Nov 2021 11:49:39 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 36 KB
11 KB 65ms
30ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 9223e6eb171099c0a8d26458e61a9219ebacc0107853337cac5a69dd821d819b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:38 GMT
content-encoding: gzip
last-modified: Sat, 13 Nov 2021 03:55:41 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0B415312D3784EC6987D7E5B797F39FB Ref B: FRAEDGE1215 Ref C: 2021-11-24T11:49:39Z
etag: "80dc6f5342d8d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10442

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 140 KB
50 KB 56ms
22ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WBPWTQ&gtm_auth=20VIJEFQxhPv2cLuHUDJVQ&gtm_preview=env-2&gtm_cookies_win=x

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c18d5b5f4a26d4533b225e7679bc22b96a4eeb9f3ef5b78f1ead5667cd20159e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: br
vary: *
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51417
x-xss-protection: 0
pragma: no-cache
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bg_desktop.png
d265rl6yp58lzi.cloudfront.net/images/home/ 5 KB
5 KB 44ms
42ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/bg_desktop.png
Requested by: Host: d265rl6yp58lzi.cloudfront.net
URL: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 4213ee7d4632fbd788b1c5ec6c0b5a31df036191cc5008bd0332754662c3685c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 12-73360555-73360556 NNNN CT(87 90 0) RT(1636470293692 2) q(0 0 2 0) r(3 3) U5
content-length: 5138
last-modified: Sun, 07 Aug 2016 14:04:32 GMT
server: nginx
etag: "57a73ff0-1412"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: ib4HZP_6EU2xwZS7aIW_NoGR7b4a1exbW-pwAvbRtiqvwtFONXhPFQ==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 4iCs6KVjbNBYlgoKfw72.woff2
fonts.gstatic.com/s/ubuntu/v15/ 33 KB
34 KB 49ms
15ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v15/4iCs6KVjbNBYlgoKfw72.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu&subset=cyrillic,latin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f4524f7e1a87079bc50a64681f880ccf3e6f5db1ec5fc27949377532a3881da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.save70.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 03:02:29 GMT
x-content-type-options: nosniff
age: 31630
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34260
x-xss-protection: 0
last-modified: Thu, 10 Sep 2020 17:02:57 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 24 Nov 2022 03:02:29 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1028252/ 75 KB
25 KB 39ms
11ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1028252/tfa.js
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7c7a944ba8e25f5217ce25880603765d9731155bad4ebf7968b54fa12df136d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id: n8Epb1f9ZXOruyU9Pj5z4_ZZcqg54urw
content-encoding: gzip
etag: "9ecdd5f46ce34bd2bc904e893bfa90ec"
age: 3342
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 24899
x-amz-id-2: eUtp8Y2P6n0WPFyvNf5P3oVNXxYDQXjUciVfY45zIGlIrxC+HqtQzoJp3Drab2YW/uvTlra+bko=
x-served-by: cache-fra19150-FRA
last-modified: Sun, 14 Nov 2021 10:14:03 GMT
server: AmazonS3
x-timer: S1637754579.022056,VS0,VE0
date: Wed, 24 Nov 2021 11:49:39 GMT
vary: Accept-Encoding
x-amz-request-id: YWDJS6J3H23TH4BR
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 69
x-cache-hits: 3

GET
H2 200 menu_hover.png
d265rl6yp58lzi.cloudfront.net/images/home/ 742 B
1 KB 45ms
45ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/menu_hover.png
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a4b1ca37d3f3d0c41e03d44698b679ce16105a8102abf7d5c6a9d15f5252e390

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 14-184556166-184556169 NNNN CT(108 93 0) RT(1636470293756 2) q(0 0 2 2) r(3 3) U5
content-length: 742
last-modified: Sun, 07 Aug 2016 14:04:39 GMT
server: nginx
etag: "57a73ff7-2e6"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: ReZSEff4tSq0xCLzcjEqB5gS2MIF3rM-4qjQriAGc0ESVVHl12yeSg==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 banner_bg.jpg
d265rl6yp58lzi.cloudfront.net/images/home/ 137 KB
138 KB 45ms
45ms Image
image/jpeg 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/banner_bg.jpg
Requested by: Host: d265rl6yp58lzi.cloudfront.net
URL: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 7b2297bb6b49f6b819aae5fd6c5d2c8f18073b1a4addb9c78101e876852c13dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 14-138693312-138693314 NNNN CT(88 90 0) RT(1636470293752 2) q(0 0 2 0) r(3 4) U5
content-length: 140393
last-modified: Sun, 07 Aug 2016 14:04:31 GMT
server: nginx
etag: "57a73fef-22469"
content-type: image/jpeg
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: ZRkqUva18BkO1gF5Ir4MfN8Zjcx3h4fWgwJ11o_BRtGox4OnNTOOUA==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 menu_active.png
d265rl6yp58lzi.cloudfront.net/images/home/ 469 B
909 B 44ms
43ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/menu_active.png
Requested by: Host: d265rl6yp58lzi.cloudfront.net
URL: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 3613eeb49b277a6f396c1f5ecb5441c06420542afc211b8ea7b3ac9297a6d30d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 12-75304951-75304952 SNNN RT(1636470293536 487) q(0 0 0 10) r(1 1) U5
content-length: 469
last-modified: Sun, 07 Aug 2016 14:04:38 GMT
server: nginx
etag: "57a73ff6-1d5"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: fwzJDZUHj4a9X3nFHLk2W2zDiWSEcNVB_azyiQafaXEMsAQhxdtp5A==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 menu_seprater.png
d265rl6yp58lzi.cloudfront.net/images/home/ 83 B
528 B 44ms
43ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/menu_seprater.png
Requested by: Host: d265rl6yp58lzi.cloudfront.net
URL: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 3e1790a16d3a781f1e44db40f942b8b117117c7534c40b66edfd0ca3010b5cc7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 5-9703139-9703140 NNNN CT(88 91 0) RT(1636470293760 2) q(0 0 2 0) r(3 3) U5
content-length: 83
last-modified: Sun, 07 Aug 2016 14:04:41 GMT
server: nginx
etag: "57a73ff9-53"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: GQUd6qgjQCr4sCPw-DYP4nfCuD0UE_WQ3L9T3aV8J9SPUl2Of3MHmQ==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 menu_bg.png
d265rl6yp58lzi.cloudfront.net/images/home/ 1 KB
1 KB 44ms
44ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/menu_bg.png
Requested by: Host: d265rl6yp58lzi.cloudfront.net
URL: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 5733d6047e6b50698d0e4a71e99ce36e9065e8f62067050964d3ab1307e6d22d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 15:04:54 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284285
x-cache: Hit from cloudfront
x-iinfo: 9-47943055-47943058 NNNN CT(86 87 0) RT(1636470293760 2) q(0 0 2 0) r(3 3) U5
content-length: 1061
last-modified: Sun, 07 Aug 2016 14:04:39 GMT
server: nginx
etag: "57a73ff7-425"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: yZu_vShtcoBObK820BS541AIScQNjxyvf3hJTIM_ORiVpZNjaSOA0g==
expires: Wed, 09 Nov 2022 15:04:54 GMT

GET
H2 200 date_box.png
d265rl6yp58lzi.cloudfront.net/images/home/ 1 KB
2 KB 40ms
39ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/images/home/date_box.png
Requested by: Host: d265rl6yp58lzi.cloudfront.net
URL: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 242450ed72468ca61ba17fe1bc46f93f43825d577ab2c6fa5fe5aeb87990a1d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d265rl6yp58lzi.cloudfront.net/find/css/style.css?250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 14:59:32 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284607
x-cache: Hit from cloudfront
x-iinfo: 10-69433568-69433570 SNNN RT(1636469970954 917) q(0 0 0 0) r(1 1) U5
content-length: 1208
last-modified: Sun, 07 Aug 2016 14:04:34 GMT
server: nginx
etag: "57a73ff2-4b8"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: M4BDSdKlWNNgGXm_cHOznsVj5sQBcX73mmDhWp3nXFTQJzQ4vS9XNg==
expires: Wed, 09 Nov 2022 14:59:32 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1001491924/ 2 KB
2 KB 41ms
18ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1001491924/?random=1637754579089&cv=9&fst=1637754579089&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.save70.com%2F&tiba=Save%2070&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df3290feb4d92d22c4441632648386eca79b416a629567d74caf6bb922d2e704

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 984
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 214144325720274 Show response
connect.facebook.net/signals/config/ 305 KB
88 KB 498ms
497ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/214144325720274?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

03c2f97b3702631aa80673b144c9555c753f40a69493206df05f6d7119db9808

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: NcZj7vXGwlCacl1l4m81Wi27o3a6mWamd2TrkgLnIusr2ButT2hdF7gnWEUAPW1g/GRjbJ/qAVkskP+qrLK9KA==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Wed, 24 Nov 2021 11:49:39 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 json Show response
trc.taboola.com/1028252/trc/3/ 2 KB
1 KB 28ms
22ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1028252/trc/3/json?tim=1637754579127&data=%7B%22id%22%3A351%2C%22ii%22%3A%22%2F%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1637754579123%2C%22cv%22%3A%2220211114-1-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.save70.com%2F%3F%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dstingrayholdings-save70-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1637754579126%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.save70.com%2F%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A41%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1028252/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9ecda8c20a62889dc7334324e2d65cb4b9b680c6a13517dff2d869c2cc4fb83c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
server: nginx
x-timer: S1637754579.140040,VS0,VE15
x-served-by: cache-fra19150-FRA
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 hp Show response
pixel.sojern.com/partner/MqOp43QDSWHn7YKE/ 3 KB
879 B 37ms
16ms Script
application/javascript 107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.sojern.com/partner/MqOp43QDSWHn7YKE/hp?ccid=08fa6a32d9b1e365f5600357737db402
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: 87247cfc79b1e5048a865482af8ec3828575b85cfe82c890e995d3ba8af740b0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
via: 1.1 google
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
content-encoding: gzip
content-type: application/javascript
alt-svc: clear
content-length: 561

GET
H2 200 ui-bg_inset-hard_100_fcfdfd_1x100.png
d265rl6yp58lzi.cloudfront.net/assets/jquery.ptTimeSelect/images/ 88 B
535 B 9ms
9ms Image
image/png 2600:9000:2156:e00:1:c9ba:9380:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d265rl6yp58lzi.cloudfront.net/assets/jquery.ptTimeSelect/images/ui-bg_inset-hard_100_fcfdfd_1x100.png
Requested by: Host: d265rl6yp58lzi.cloudfront.net
URL: https://d265rl6yp58lzi.cloudfront.net/assets/jquery.ptTimeSelect/jquery-ui.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:e00:1:c9ba:9380:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: d175ae345afe14519bca3ebe152a9f863e5116f8993a641c26f619f926436df0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d265rl6yp58lzi.cloudfront.net/assets/jquery.ptTimeSelect/jquery-ui.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 09 Nov 2021 14:59:22 GMT
via: 1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
x-cdn: Imperva
age: 1284617
x-cache: Hit from cloudfront
x-iinfo: 12-130942277-130942278 NNNN CT(93 89 0) RT(1636469961349 2) q(0 0 2 0) r(3 3) U5
content-length: 88
last-modified: Sun, 07 Aug 2016 13:43:32 GMT
server: nginx
etag: "57a73b04-58"
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: vEVrf8C0qhU3ooNFquRU-S7K51M3W1oxvxFKy6jed84BP2Wilryn-w==
expires: Wed, 09 Nov 2022 14:59:22 GMT

GET
H2 204 27000254.js Show response
bat.bing.com/p/action/ 0
117 B 31ms
31ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/27000254.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 24 Nov 2021 11:49:39 GMT
cache-control: private,max-age=1800
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 74CE463B4DA04BBFBEFD564D6F45E339 Ref B: FRAEDGE1215 Ref C: 2021-11-24T11:49:39Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
150 B 30ms
29ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=27000254&Ver=2&mid=0f1f0dcb-497d-4052-8a12-25771208ff42&sid=9ab691104d1c11ec89c4df3802bf97e6&vid=9ab68b904d1c11ec97c1d71608c30a12&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Save%2070&kw=Flight%20tickets%20,%20Hotels%20prices%20worldwide%20,%20%20Car%20rental%20prices&p=https%3A%2F%2Fwww.save70.com%2F&r=&lt=1188&evt=pageLoad&msclkid=N&sv=1&rn=133946
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4847D3C0E9494AAF9D30B4B0A9C2D651 Ref B: FRAEDGE1215 Ref C: 2021-11-24T11:49:39Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/ 270 KB
97 KB 46ms
32ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3049526025298869&plah=www.save70.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16b0243565348bfe19de119830f59c24f77935d36639dccca01d21a2747c3ae5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99574
x-xss-protection: 0
server: cafe
etag: 4165656742694041468
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 24 Nov 2021 11:49:39 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/ Frame 8451 11 KB
5 KB 21ms
7ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 24 Nov 2021 06:55:30 GMT
expires: Wed, 08 Dec 2021 06:55:30 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 17649
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 _Incapsula_Resource
www.save70.com/ 1 B
35 B 7ms
6ms Image
text/plain 107.154.142.143
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.save70.com/_Incapsula_Resource?SWKMTFSR=1&e=0.02996354661696876
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.142.143 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.142.143.ip.incapdns.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 1
content-type: text/plain

GET
H3 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 37 KB
14 KB 63ms
45ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBPWTQ&gtm_auth=20VIJEFQxhPv2cLuHUDJVQ&gtm_preview=env-2&gtm_cookies_win=x

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14378
x-xss-protection: 0
server: cafe
etag: 684346926396516684
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 24 Nov 2021 11:49:39 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBPWTQ&gtm_auth=20VIJEFQxhPv2cLuHUDJVQ&gtm_preview=env-2&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 876
date: Wed, 24 Nov 2021 11:35:03 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 24 Nov 2021 13:35:03 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1001491924/ 42 B
548 B 43ms
20ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1001491924/?random=1637754579089&cv=9&fst=1637751600000&num=1&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.save70.com%2F&tiba=Save%2070&fmt=3&is_vtc=1&random=2785791197&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1001491924/ 42 B
548 B 42ms
19ms Image
image/gif 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1001491924/?random=1637754579089&cv=9&fst=1637751600000&num=1&guid=ON&eid=375603261&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.save70.com%2F&tiba=Save%2070&fmt=3&is_vtc=1&random=2785791197&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
trc.taboola.com/1072627/trc/3/ 2 KB
1 KB 25ms
25ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1072627/trc/3/json?tim=1637754579272&data=%7B%22id%22%3A849%2C%22ii%22%3A%22%2F%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1637754579123%2C%22cv%22%3A%2220211114-1-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.save70.com%2F%3F%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback1%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dstingrayholdings-save70-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1637754579131%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.save70.com%2F%22%2C%22tos%22%3A6%2C%22ssd%22%3A1%2C%22scd%22%3A41%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1028252/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: dce37dc5a236ef35002a058b2e0fb94bacb9417230fea771de014bfc454d7c22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-vcl-time-ms: 19
date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
server: nginx
x-timer: S1637754579.275852,VS0,VE19
x-served-by: cache-fra19150-FRA
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2

200

AdX
pixel.sojern.com/idSync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=WnrJaSkpQ_SWWmBT1KYssg&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0...
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj&google_gid=CAESEPPSjMkEqmBvgNBG0hwfOzg&google_cver=1

42 B
283 B

16ms
15ms

Image
image/gif

107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj&google_gid=CAESEPPSjMkEqmBvgNBG0hwfOzg&google_cver=1
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
via: 1.1 google
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc: clear
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj&google_gid=CAESEPPSjMkEqmBvgNBG0hwfOzg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 389
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
fcmatch.youtube.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_hm=WnrJaSkpQ_SWWmBT1KYssg&google_nid=sojern_adh
https://fcmatch.google.com/pixel?google_gm=AMnCDoqM2XOcbl-hvS3E9_fBeVP1npr1HlC9G6Ljd21se3hAHcv4Th3y_tnWLz3lG94mdsLic9J3LFSQ0tQxDakO3aReXBiFmxe9Jw2sQPdhOSQVp6k6ADw
https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqM2XOcbl-hvS3E9_fBeVP1npr1HlC9G6Ljd21se3hAHcv4Th3y_tnWLz3lG94mdsLic9J3LFSQ0tQxDakO3aReXBiFmxe9Jw2sQPdhOSQVp6k6ADw

170 B
244 B

66ms
51ms

Image
image/png

2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqM2XOcbl-hvS3E9_fBeVP1npr1HlC9G6Ljd21se3hAHcv4Th3y_tnWLz3lG94mdsLic9J3LFSQ0tQxDakO3aReXBiFmxe9Jw2sQPdhOSQVp6k6ADw

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqM2XOcbl-hvS3E9_fBeVP1npr1HlC9G6Ljd21se3hAHcv4Th3y_tnWLz3lG94mdsLic9J3LFSQ0tQxDakO3aReXBiFmxe9Jw2sQPdhOSQVp6k6ADw
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 360
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

apn
pixel.sojern.com/idsync/
Redirect Chain

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fpixel.sojern.com%2Fidsync%2Fapn%3Fid%3D%24UID%26sjrn_id%3DzRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj
https://pixel.sojern.com/idsync/apn?id=3578895244101527089&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj

42 B
264 B

15ms
15ms

Image
image/gif

107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/apn?id=3578895244101527089&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
via: 1.1 google
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc: clear
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Wed, 24 Nov 2021 11:49:39 GMT
X-Proxy-Origin: 136.243.198.82; 136.243.198.82; 623.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: bee40844-1444-4971-a86a-de880edea22b
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://pixel.sojern.com/idsync/apn?id=3578895244101527089&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ttd
pixel.sojern.com/idsync/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=ombl9hp&ttd_puid=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj&ttd_tpi=1
https://pixel.sojern.com/idsync/ttd?id=4c7d56d2-689a-4c1b-ae17-95ab8021b9a6&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj

42 B
275 B

16ms
16ms

Image
image/gif

107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/ttd?id=4c7d56d2-689a-4c1b-ae17-95ab8021b9a6&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
via: 1.1 google
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc: clear
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.sojern.com/idsync/ttd?id=4c7d56d2-689a-4c1b-ae17-95ab8021b9a6&sjrn_id=zRJ79VikrZYtJjXsE_fDzhiYTF4XQV8RsoerpEtV090ZPSZYRd0ZIvebn1kIt7cj
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 327

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 200 B
636 B 41ms
15ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.save70.com&callback=_gfp_s_&client=ca-pub-3049526025298869

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3049526025298869&plah=www.save70.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

c4aa87f824ccf480ccac8570059622c97ee0c1d68fbd59c6513cb99ac3116ea0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 192
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 40ms
16ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.save70.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 40ms
16ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.save70.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CEC2 24 KB
11 KB 524ms
524ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=8489995635&adk=3434802048&adf=3656457494&pi=t.ma~as.8489995635&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579183&bpp=4&bdt=270&idt=112&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=8687902763839&frm=20&pv=2&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClepEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZfWoh0Xf5f&p=https%3A//www.save70.com&dtd=133

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daf0685cf506d375d13c9fc6d13c2f9fc4b391b76b32514e3e78e93b4b7ac360

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 24 Nov 2021 11:49:39 GMT
server: cafe
content-length: 11607
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 24 Nov 2021 11:49:39 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E243 108 KB
36 KB 1131ms
1129ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=5536529239&adk=744374605&adf=3700167759&pi=t.ma~as.5536529239&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579187&bpp=1&bdt=274&idt=136&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=8687902763839&frm=20&pv=1&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1100&ady=1145&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=NXrK5Vwp92&p=https%3A//www.save70.com&dtd=139

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a6dd6978e1f496391bb929b5736a6e056841050226d5da02e33e381576ede93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 24 Nov 2021 11:49:40 GMT
server: cafe
content-length: 37216
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 24 Nov 2021 11:49:40 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 085B 0
16 B 29ms
29ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&adk=1812271804&adf=3025194257&lmt=1637754579&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.save70.com%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579196&bpp=1&bdt=283&idt=135&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250%2C300x250&nras=1&correlator=8687902763839&frm=20&pv=1&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=138

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 24 Nov 2021 11:49:39 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 28ms
14ms XHR
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1367345673&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.save70.com%2F&ul=en-us&de=UTF-8&dt=Save%2070&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=page&ea=visit&el=home&_u=YAhAAAABAAAAAC~&jid=1755063415&gjid=310134402&cid=644411650.1637754579&tid=UA-42783156-1&_gid=871876041.1637754579&_r=1&gtm=2wgba1WBPWTQ&cd18=home&z=379063017

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.save70.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.save70.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/878338625/ 2 KB
1 KB 56ms
56ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/878338625/?random=1637754579347&cv=9&fst=1637754579347&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&ig=1&data=flight_destid%3D%3Bflight_originid%3D%3Bflight_pagetype%3Dhome%3Bflight_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.save70.com%2F&tiba=Save%2070&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4397efbc9d01dcb4383734712b4e2290bc238020932a38ab16d77ef680e48c7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1037
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
0 39ms
39ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gfp_cw_status&domain=save70.com&host=www.save70.com&success=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
441 B 46ms
15ms XHR
text/plain 2a00:1450:400c:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-42783156-1&cid=644411650.1637754579&jid=1755063415&gjid=310134402&_gid=871876041.1637754579&_u=YAhAAAAAAAAAAC~&z=1344855893

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c1b::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.save70.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 24 Nov 2021 11:49:39 GMT
content-type: text/plain
access-control-allow-origin: https://www.save70.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/878338625/ 42 B
64 B 34ms
18ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/878338625/?random=1637754579347&cv=9&fst=1637751600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&data=flight_destid%3D%3Bflight_originid%3D%3Bflight_pagetype%3Dhome%3Bflight_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.save70.com%2F&tiba=Save%2070&async=1&fmt=3&is_vtc=1&random=3817840316&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/878338625/ 42 B
64 B 35ms
19ms Image
image/gif 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/878338625/?random=1637754579347&cv=9&fst=1637751600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&data=flight_destid%3D%3Bflight_originid%3D%3Bflight_pagetype%3Dhome%3Bflight_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.save70.com%2F&tiba=Save%2070&async=1&fmt=3&is_vtc=1&random=3817840316&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 31ms
31ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-42783156-1&cid=644411650.1637754579&jid=1755063415&_u=YAhAAAAAAAAAAC~&z=462987955

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 30ms
29ms Image
image/gif 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-42783156-1&cid=644411650.1637754579&jid=1755063415&_u=YAhAAAAAAAAAAC~&z=462987955

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
295 B 21ms
7ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=214144325720274&ev=PageView&dl=https%3A%2F%2Fwww.save70.com%2F&rl=&if=false&ts=1637754579647&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1637754579646.1830282056&it=1637754579120&coo=false&rqm=GET

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Wed, 24 Nov 2021 11:49:39 GMT

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame CEC2 3 KB
2 KB 78ms
26ms Script
application/x-javascript 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTm1JMVlqQmtObUl0WXpSaU5TMHlNV00yTFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5MTgzOTA5Njk5ODg4NzUzNDgvNjYyMjMyNi80NTYyMzA2LzQvY0lTNWM2YW9mLXRTLVFUZUFWYWJVYzBNOG04NXJqLXo4ZnJmaHlhRDM0QS8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC8zOTE4MzkwOTY5OTg4ODc1MzQ4L3pyaC8wLzQzNC81My85OTkvMzIyLzJhMDE6NGY4OjIxMjo6LzAuMDAwLzE2Mzc3NTQ1NzkvMTYzNzc2NzE3OS80L3B1Yi0zMDQ5NTI2MDI1Mjk4ODY5Lw/OzpWm0fjcN5SPHQcNMxDPhWtXi0&nodeid=2632&group=zrh&auctionid=3918390969988875348&shardkey=3918390969988875348&sid=4562306&cid=6622326&bp=a_bgafhj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.159&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%26client%3Dca-pub-3049526025298869%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=8489995635&adk=3434802048&adf=3656457494&pi=t.ma~as.8489995635&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579183&bpp=4&bdt=270&idt=112&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=8687902763839&frm=20&pv=2&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClepEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZfWoh0Xf5f&p=https%3A//www.save70.com&dtd=133
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.209.5 /
Resource Hash: 8b6805e13496ee237f59460d6d72f7af8d512cb9786278ce9605514566ddc8a1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:39 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1637754579
Last-Modified: Wed, 24 Nov 2021 11:49:39 GMT
Server: MMBD/3.209.5
x-mm-latency: 3 (2)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: zrh-router-x70, zrh-bidder-x146
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Wed, 24 Nov 2021 11:49:38 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame CEC2 2 KB
1 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=8489995635&adk=3434802048&adf=3656457494&pi=t.ma~as.8489995635&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579183&bpp=4&bdt=270&idt=112&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=8687902763839&frm=20&pv=2&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClepEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZfWoh0Xf5f&p=https%3A//www.save70.com&dtd=133

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Dec 2021 11:47:23 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CEC2 119 KB
37 KB 70ms
47ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Nov 2021 11:49:39 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame CEC2 15 KB
7 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:45:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 236
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Dec 2021 11:45:43 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame CEC2 0
0 48ms
48ms Fetch
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CZkj70yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTdAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBACKxmVkSq2K3J9x0bbXasHxjoUesvUwOf0f2RQbFUj6rQa-YOvCgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMzA0OTUyNjAyNTI5ODg2ORgA&sigh=NEFE-tq-yJ4&uach_m=[UACH]&cid=CAQSKQCNIrLMxDK9oYzAviLjlA_ut6IDWbHWWH0KI6kV60pTGtZXvsqGL5acGAE&tpd=AGWhJmv2F4On4AHJ_-qmzF100CRm1rBFvh4jKTAJhS-jVICNITwJP9nekqwjLTi5VHOUofm46bUtZCUlfzi8Tn6uVvozFXIySyZBrVfpuk_L39OliZzsZdWy1cZSBq1w4ySHEbE_XpV4IUd3Zro2sRuKa9lmR10rhO9_6KIL7NMG0Dei7zM49HftvisUaf0HRgdNDiKnyo6NA9G8FAuS7zFCxBVb6GaSQPyIs13uGZfxkg0ouYT1ZCBfEsQa-bW5YINB2g7GxY17WeyOd-XF93DG1XgvSg8_HqIPX5n4LVC1EjYgiKMtGqNXQ6hG0Cs5okIzxCL6nxzNktl5XesCvQ-Nf2f8McFog7pG4vaoirlOJmHe1yp9BG9H762awpipmkgQ8WXoLyyRgybFqAYg3C_tpvFhwhjkmQm3R4ZROsXa5H9cUH8BCpIsaYIrErSKVj6UqDVRDw_4av9Vw-q9QSuzNnjIjkcTIg6cgapSZ9Lhr-uLheW3JLgvnlVYCanpRoXPzFM9qhXazb_l14y8nwmRs3VPcRhEArobzwFepw3Wq6n7jW5ft9hT3RDTazygg-6tIW1Mp-qnKJr3PyGqd86CW-kuMgVKH8olmkXEn2SDvBId4LkEeCzVq-tes_ipgFDe8Gec-uRcbJ9DIwhQ5j-UXTO78qkwlI5xFugA5mveTWZAAJ9MZBHFFl15-c7pXPCZ75RVLM4pQerHdJAsatGMC73iOepIsOgw1j1E4MO2fg12y7ZhOrkalDLsVFWrGxPvRjfMoBKNWctS01cDm6P_QLa93rxIYce1uX2Ni4G04ftyAUpMuTM173nwIC50H6BFjI1Z-HXLzRg4iEfEp5sP_TGqrG4AhTSYnrGcIbXPi3jpVKROFmkpX1mVYYMDd6A5bncxh21WKt3OthnCZ1Bs6m5EKgt8dDTeg1va0AmxtZ6hkkOfnYFqZVnArBao81-EU1CFotanFRP85YJ8G01puTthvbLodFxOv1zXoSmuDVP0tbaxgZZpl3pbwj_vOafkz-aLTG4a4XlXFLsrSOweyXWc79BfFTEpIbrNmVE7sUMtgeEyNp6k_F-uCQOK2OrAeoQ3jYQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=8489995635&adk=3434802048&adf=3656457494&pi=t.ma~as.8489995635&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579183&bpp=4&bdt=270&idt=112&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=8687902763839&frm=20&pv=2&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClepEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZfWoh0Xf5f&p=https%3A//www.save70.com&dtd=133
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 24 Nov 2021 11:49:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK 01qrvgnrrbds Show response
hal9000.redintelligence.net/zone/ Frame CEC2 10 KB
3 KB 12ms
2ms Script
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/01qrvgnrrbds?subid=&gdpr=1&gdpr_consent=li&rnd=3918390969988875348&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D3918390969988875348%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_cid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%2526client%253Dca-pub-3049526025298869%2526adurl%253D%26redirect%3D
Requested by: Host: www.save70.com
URL: https://www.save70.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: b9851486796787854388d4b2d20436ffa320cda2d001f6caa0cd57489f532789

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:39 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3311
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame CEC2 49 B
330 B 64ms
23ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=3918390969988875348&node_id=2632&exch_id=4
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTm1JMVlqQmtObUl0WXpSaU5TMHlNV00yTFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5MTgzOTA5Njk5ODg4NzUzNDgvNjYyMjMyNi80NTYyMzA2LzQvY0lTNWM2YW9mLXRTLVFUZUFWYWJVYzBNOG04NXJqLXo4ZnJmaHlhRDM0QS8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC8zOTE4MzkwOTY5OTg4ODc1MzQ4L3pyaC8wLzQzNC81My85OTkvMzIyLzJhMDE6NGY4OjIxMjo6LzAuMDAwLzE2Mzc3NTQ1NzkvMTYzNzc2NzE3OS80L3B1Yi0zMDQ5NTI2MDI1Mjk4ODY5Lw/OzpWm0fjcN5SPHQcNMxDPhWtXi0&nodeid=2632&group=zrh&auctionid=3918390969988875348&shardkey=3918390969988875348&sid=4562306&cid=6622326&bp=a_bgafhj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.159&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%26client%3Dca-pub-3049526025298869%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.209.5 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:39 GMT
Server: MMBD/3.209.5
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x40, zrh-bidder-x146
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Wed, 24 Nov 2021 11:49:38 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame CEC2 43 B
405 B 55ms
23ms Image
image/gif 184.30.20.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=3918390969988875348&v3=651871&v4=4562306&v5=6622326&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTm1JMVlqQmtObUl0WXpSaU5TMHlNV00yTFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5MTgzOTA5Njk5ODg4NzUzNDgvNjYyMjMyNi80NTYyMzA2LzQvY0lTNWM2YW9mLXRTLVFUZUFWYWJVYzBNOG04NXJqLXo4ZnJmaHlhRDM0QS8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC8zOTE4MzkwOTY5OTg4ODc1MzQ4L3pyaC8wLzQzNC81My85OTkvMzIyLzJhMDE6NGY4OjIxMjo6LzAuMDAwLzE2Mzc3NTQ1NzkvMTYzNzc2NzE3OS80L3B1Yi0zMDQ5NTI2MDI1Mjk4ODY5Lw/OzpWm0fjcN5SPHQcNMxDPhWtXi0&nodeid=2632&group=zrh&auctionid=3918390969988875348&shardkey=3918390969988875348&sid=4562306&cid=6622326&bp=a_bgafhj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.159&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%26client%3Dca-pub-3049526025298869%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.207 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-207.deploy.static.akamaitechnologies.com
Software: MT3 4133 baa842e master zrh-pixel-x27 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:39 GMT
Server: MT3 4133 baa842e master zrh-pixel-x27 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 24 Nov 2021 11:49:38 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame CEC2 49 B
330 B 66ms
23ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=3918390969988875348&st=4562306&time=1637754579&nodeid=2632
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTm1JMVlqQmtObUl0WXpSaU5TMHlNV00yTFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5MTgzOTA5Njk5ODg4NzUzNDgvNjYyMjMyNi80NTYyMzA2LzQvY0lTNWM2YW9mLXRTLVFUZUFWYWJVYzBNOG04NXJqLXo4ZnJmaHlhRDM0QS8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC8zOTE4MzkwOTY5OTg4ODc1MzQ4L3pyaC8wLzQzNC81My85OTkvMzIyLzJhMDE6NGY4OjIxMjo6LzAuMDAwLzE2Mzc3NTQ1NzkvMTYzNzc2NzE3OS80L3B1Yi0zMDQ5NTI2MDI1Mjk4ODY5Lw/OzpWm0fjcN5SPHQcNMxDPhWtXi0&nodeid=2632&group=zrh&auctionid=3918390969988875348&shardkey=3918390969988875348&sid=4562306&cid=6622326&bp=a_bgafhj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.159&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%26client%3Dca-pub-3049526025298869%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.209.5 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:39 GMT
Server: MMBD/3.209.5
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x38, zrh-bidder-x146
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Wed, 24 Nov 2021 11:49:38 GMT

GET
H/1.1 200
OK request.php Show response
hal900019.redintelligence.net/ Frame CEC2 4 KB
2 KB 76ms
60ms Script
application/x-javascript 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900019.redintelligence.net/request.php?zone=01qrvgnrrbds&nw=20&renderingType=javascript&namespace=50e5317f4d&subid=&uid=bf857680d37ba50d&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D3918390969988875348%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_cid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%2526client%253Dca-pub-3049526025298869%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-3049526025298869%26output%3Dhtml%26h%3D250%26slotname%3D8489995635%26adk%3D3434802048%26adf%3D3656457494%26pi%3Dt.ma~as.8489995635%26w%3D300%26lmt%3D1637754579%26psa%3D0%26format%3D300x250%26url%3Dhttps%253A%252F%252Fwww.save70.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1637754579183%26bpp%3D4%26bdt%3D270%26idt%3D112%26shv%3Dr20211111%26mjsv%3Dm202111110101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D8687902763839%26frm%3D20%26pv%3D2%26ga_vid%3D644411650.1637754579%26ga_sid%3D1637754579%26ga_hid%3D1367345673%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26oid%3D2%26pvsid%3D4361073289980788%26pem%3D631%26tmod%3D1484715730%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257ClepEr%257C%26abl%3DCS%26pfx%3D0%26fu%3D32768%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DZfWoh0Xf5f%26p%3Dhttps%253A%2F%2Fwww.save70.com%26dtd%3D133&ancestorOrigins=null&random=1556704023888&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/01qrvgnrrbds?subid=&gdpr=1&gdpr_consent=li&rnd=3918390969988875348&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D3918390969988875348%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_cid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%2526client%253Dca-pub-3049526025298869%2526adurl%253D%26redirect%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 913c334189d1f0b9fe7bf564d158f4985a17ceb8d6e2cab4e5e659bc7e265735

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Nov 2021 11:49:39 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 42655700085917500951393011788019
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1428
Expires: Wed, 24 Nov 2021 11:49:39 +0100

GET
H/1.1

200
OK

cshow.php Show response
www.zenaps.com/ Frame B389
Redirect Chain

https://www.awin1.com/cshow.php?s=2329635&v=16160&q=356171&r=296283&pref1=42655700085917500951393011788019&pv=1
https://www.zenaps.com/cshow.php?pvr=9b3de2b0-4d1c-11ec-9d39-2236c0dc0c5d&v=16160&r=296283&q=356171&s=2329635&viewref=42655700085917500951393011788019&pv=1

43 B
704 B

28ms
14ms

Document
image/gif

23.79.145.223
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zenaps.com/cshow.php?pvr=9b3de2b0-4d1c-11ec-9d39-2236c0dc0c5d&v=16160&r=296283&q=356171&s=2329635&viewref=42655700085917500951393011788019&pv=1

Requested by

Host: hal900019.redintelligence.net
URL: https://hal900019.redintelligence.net/request.php?zone=01qrvgnrrbds&nw=20&renderingType=javascript&namespace=50e5317f4d&subid=&uid=bf857680d37ba50d&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D3918390969988875348%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_cid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%2526client%253Dca-pub-3049526025298869%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-3049526025298869%26output%3Dhtml%26h%3D250%26slotname%3D8489995635%26adk%3D3434802048%26adf%3D3656457494%26pi%3Dt.ma~as.8489995635%26w%3D300%26lmt%3D1637754579%26psa%3D0%26format%3D300x250%26url%3Dhttps%253A%252F%252Fwww.save70.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1637754579183%26bpp%3D4%26bdt%3D270%26idt%3D112%26shv%3Dr20211111%26mjsv%3Dm202111110101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D8687902763839%26frm%3D20%26pv%3D2%26ga_vid%3D644411650.1637754579%26ga_sid%3D1637754579%26ga_hid%3D1367345673%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26oid%3D2%26pvsid%3D4361073289980788%26pem%3D631%26tmod%3D1484715730%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257ClepEr%257C%26abl%3DCS%26pfx%3D0%26fu%3D32768%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DZfWoh0Xf5f%26p%3Dhttps%253A%2F%2Fwww.save70.com%26dtd%3D133&ancestorOrigins=null&random=1556704023888&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.79.145.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-79-145-223.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Content-Type: image/gif
Content-Length: 43
Expires: 0
Pragma: no-cache
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Date: Wed, 24 Nov 2021 11:49:40 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

Redirect headers

Content-Length: 0
Location: https://www.zenaps.com/cshow.php?pvr=9b3de2b0-4d1c-11ec-9d39-2236c0dc0c5d&v=16160&r=296283&q=356171&s=2329635&viewref=42655700085917500951393011788019&pv=1
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Date: Wed, 24 Nov 2021 11:49:40 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
H2 200 script.js Show response
img.metaffiliation.com/na/na/res/trk/ Frame CEC2 128 KB
33 KB 63ms
7ms Script
application/javascript 192.229.220.129
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://img.metaffiliation.com/na/na/res/trk/script.js
Requested by: Host: hal900019.redintelligence.net
URL: https://hal900019.redintelligence.net/request.php?zone=01qrvgnrrbds&nw=20&renderingType=javascript&namespace=50e5317f4d&subid=&uid=bf857680d37ba50d&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D3918390969988875348%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_cid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%2526client%253Dca-pub-3049526025298869%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-3049526025298869%26output%3Dhtml%26h%3D250%26slotname%3D8489995635%26adk%3D3434802048%26adf%3D3656457494%26pi%3Dt.ma~as.8489995635%26w%3D300%26lmt%3D1637754579%26psa%3D0%26format%3D300x250%26url%3Dhttps%253A%252F%252Fwww.save70.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1637754579183%26bpp%3D4%26bdt%3D270%26idt%3D112%26shv%3Dr20211111%26mjsv%3Dm202111110101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D8687902763839%26frm%3D20%26pv%3D2%26ga_vid%3D644411650.1637754579%26ga_sid%3D1637754579%26ga_hid%3D1367345673%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26oid%3D2%26pvsid%3D4361073289980788%26pem%3D631%26tmod%3D1484715730%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257ClepEr%257C%26abl%3DCS%26pfx%3D0%26fu%3D32768%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DZfWoh0Xf5f%26p%3Dhttps%253A%2F%2Fwww.save70.com%26dtd%3D133&ancestorOrigins=null&random=1556704023888&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.220.129 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F65) /
Resource Hash: 7c22b007743a09ec0ad5931edb3cc96fa88009586b10e0d3c502eeca52fbb183

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:40 GMT
content-encoding: gzip
last-modified: Tue, 19 Oct 2021 09:25:18 GMT
server: ECAcc (frc/8F65)
age: 1705
etag: "616e8efe-201f0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=600, s-maxage=3600
accept-ranges: bytes
content-length: 33512

GET
H/1.1 200
OK trk.php
action.metaffiliation.com/ Frame CEC2 43 B
2 KB 116ms
33ms Image
image/gif 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://action.metaffiliation.com/trk.php?taff=P511E19571C9F151&argsite=42655700085917500951393011788019&gdprconsent=li
Requested by: Host: hal900019.redintelligence.net
URL: https://hal900019.redintelligence.net/request.php?zone=01qrvgnrrbds&nw=20&renderingType=javascript&namespace=50e5317f4d&subid=&uid=bf857680d37ba50d&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D3918390969988875348%26mt_id%3D6622326%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_cid%3Dafc5619e-26d3-4c01-8cb7-c73b4b58a6c3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBZGP0yaeYZvYFJ6C1fAP1t-q-AfPh46bXMCG2YLGAsCNtwEQASAAYJX68IGMB4IBF2NhLXB1Yi0zMDQ5NTI2MDI1Mjk4ODY5yAEJqAMBqgTgAU_Qqpld6oT4MVe0w8c8WmD7x2ODOJ_2XoC1OvDWlniSCsa98AnXzJhgBcuW7skZ7ZGaWRGUORArCpfR1P0PVJnwxWgeW27eqTzMnhNh8YLPI8p6IHDlisVE2I2hbWcoW1ap3HcGrKj2CXmdBBmXr7_7OXfkQUXc_HMXKXfbET_2KeFamAqIDdxUr5UKrZb44PiimwYyTbN5DmqfU6FZc6c4OvGVJZFyPtDDI5GaRUbV5xJhbrJTBEKI5_fI9gmNUTs5em6XxTHsmo-iuNso2EDfmbvhtFbWtagn3OxPUzeFgAaQpezv4ZiAztcBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_0IdIIgsxnb_mh7Y67cazyfhNBArA%2526client%253Dca-pub-3049526025298869%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-3049526025298869%26output%3Dhtml%26h%3D250%26slotname%3D8489995635%26adk%3D3434802048%26adf%3D3656457494%26pi%3Dt.ma~as.8489995635%26w%3D300%26lmt%3D1637754579%26psa%3D0%26format%3D300x250%26url%3Dhttps%253A%252F%252Fwww.save70.com%252F%26flash%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1637754579183%26bpp%3D4%26bdt%3D270%26idt%3D112%26shv%3Dr20211111%26mjsv%3Dm202111110101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D8687902763839%26frm%3D20%26pv%3D2%26ga_vid%3D644411650.1637754579%26ga_sid%3D1637754579%26ga_hid%3D1367345673%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26oid%3D2%26pvsid%3D4361073289980788%26pem%3D631%26tmod%3D1484715730%26eae%3D0%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257ClepEr%257C%26abl%3DCS%26pfx%3D0%26fu%3D32768%26bc%3D31%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DZfWoh0Xf5f%26p%3Dhttps%253A%2F%2Fwww.save70.com%26dtd%3D133&ancestorOrigins=null&random=1556704023888&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:40 GMT
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR CUR ADMa PSAa OUR IND NAV COM",policyref="http://www.netaffiliation.com/w3c/p3p.xml"
X-TRK-D: 0.0065431594848633
Connection: close
Pragma: no-cache
X-TRK-PROC: 73241
Last-Modified: Wed, 24 Nov 2021 11:49:40 GMT
Server: nginx
X-TRK-DECISION: 7
Content-Type: image/gif
Access-Control-Allow-Origin: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
X-TRK-SRV: 9

GET
H/1.1

200
OK

ai.aspx
m.exactag.com/ Frame CEC2
Redirect Chain

https://action.metaffiliation.com/trk.php?mann=P511E19571C9F151&argsite=42655700085917500951393011788019&gdprconsent=li
https://m.exactag.com/ai.aspx?extProvId=8&extPu=esprit-dcm&extLi=25444971&extPm=319075961&extCr=&rnd=%n&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_312}

43 B
1 KB

67ms
16ms

Image
image/gif

85.14.248.91
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=8&extPu=esprit-dcm&extLi=25444971&extPm=319075961&extCr=&rnd=%n&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_312}

Requested by

Protocol

HTTP/1.1

Server

85.14.248.91 Kamp-Lintfort, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mi, 24 Nov 2021 11:49:40 GMT
Server: Microsoft-IIS/8.5
Date: Wed, 24 Nov 2021 11:49:39 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1788
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Wed, 24 Nov 2021 11:49:40 GMT
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
X-TRK-D: 0.004472017288208
Connection: close
Pragma: no-cache
X-TRK-PROC: 73241
Last-Modified: Wed, 24 Nov 2021 11:49:40 GMT
Server: nginx
X-TRK-DECISION: -3
Content-Type: text/html; charset=UTF-8
Location: https://m.exactag.com/ai.aspx?extProvId=8&extPu=esprit-dcm&extLi=25444971&extPm=319075961&extCr=&rnd=%n&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_312}
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
X-TRK-SRV: 9

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame CEC2 1 KB
2 KB 247ms
126ms Script
text/html 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3392345&wgcampaignid=99582&viewref=42655700085917500951393011788019&js=1&nw=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=8489995635&adk=3434802048&adf=3656457494&pi=t.ma~as.8489995635&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579183&bpp=4&bdt=270&idt=112&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=8687902763839&frm=20&pv=2&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClepEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZfWoh0Xf5f&p=https%3A//www.save70.com&dtd=133
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 743d8dd17fe3e0b81fb2f8712ea50a68e6ada040eef817ea96bff94c424b48b3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Nov 2021 11:49:40 GMT
Last-Modified: Wed, 24 Nov 2021 11:49:40 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1239
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

activityi;dc_pre=COrB65_3sPQCFU8eBgAdaysEwg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237 Show response
5994599.fls.doubleclick.net/ Frame 4750
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237?
https://5994599.fls.doubleclick.net/activityi;dc_pre=COrB65_3sPQCFU8eBgAdaysEwg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237?

391 B
345 B

170ms
156ms

Document
text/html

216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=COrB65_3sPQCFU8eBgAdaysEwg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f166.1e100.net

Software

cafe /

Resource Hash

e006e177ff87d113bb28d661d5f39d27e718538d3c7f1a1d39fcd9e3cf53ff32

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 24 Nov 2021 11:49:40 GMT
expires: Wed, 24 Nov 2021 11:49:40 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 322
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 24 Nov 2021 11:49:40 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=COrB65_3sPQCFU8eBgAdaysEwg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900019.redintelligence.net/ Frame EF98 7 KB
2 KB 6ms
3ms Document
text/html 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900019.redintelligence.net/request_content.php?s=42655700085917500951393011788019&a=e05e8d31
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=8489995635&adk=3434802048&adf=3656457494&pi=t.ma~as.8489995635&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579183&bpp=4&bdt=270&idt=112&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=8687902763839&frm=20&pv=2&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClepEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZfWoh0Xf5f&p=https%3A//www.save70.com&dtd=133
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: aad2cff9c8321968a5e16a384d96ca01da5eca8a7ae3cec7944362cd032aa13d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Wed, 24 Nov 2021 11:49:40 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Wed, 24 Nov 2021 11:49:40 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2100
Connection: close
Content-Type: text/html; charset=utf-8

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6DA3 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 24 Nov 2021 05:53:44 GMT
expires: Thu, 25 Nov 2021 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 21356
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 kwanko-sdk-iframe.html Show response
img.metaffiliation.com/ Frame 72C6 3 KB
992 B 10ms
9ms Document
text/html 192.229.220.129
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://img.metaffiliation.com/kwanko-sdk-iframe.html
Requested by: Host: img.metaffiliation.com
URL: https://img.metaffiliation.com/na/na/res/trk/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.220.129 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FB0) /
Resource Hash: 2d43c04a2d2f68039cedc241e492503a5e0d93a2cafb3be130993b3e3dfd8d4a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
age: 1163
cache-control: public, max-age=600, s-maxage=3600
content-type: text/html
date: Wed, 24 Nov 2021 11:49:40 GMT
etag: "5fd78d26-ac5"
last-modified: Mon, 14 Dec 2020 16:04:54 GMT
server: ECAcc (frc/8FB0)
vary: Accept-Encoding
x-cache: HIT
content-length: 891

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 15ms
6ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=214144325720274&ev=Microdata&dl=https%3A%2F%2Fwww.save70.com%2F&rl=&if=false&ts=1637754580164&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Save%2070%22%2C%22meta%3Adescription%22%3A%22Our%20mission%20is%20to%20help%20you%20save%20when%20you%20make%20your%20reservations%20and%20also%20while%20traveling.%20Here%20you%20can%20find%20travel%20info%20%26%20price%20comparison%20for%20hotels%20flights%20cruises%20and%20car%20rentals.%20Happy%20Travel.%22%2C%22meta%3Akeywords%22%3A%22Flight%20tickets%20%2C%20Hotels%20prices%20worldwide%20%2C%20%20Car%20rental%20prices%22%7D&cd[OpenGraph]=%7B%22og%3Aimage%22%3A%22http%3A%2F%2Fd265rl6yp58lzi.cloudfront.net%2Fimages%2FopenGraph.jpg%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fd265rl6yp58lzi.cloudfront.net%2Fimages%2FopenGraph.jpg%22%2C%22og%3Aimage%3Awidth%22%3A%221200%22%2C%22og%3Aimage%3Aheight%22%3A%221200%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.48&r=stable&ec=1&o=30&fbp=fb.1.1637754579646.1830282056&it=1637754579120&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: www.save70.com
URL: https://www.save70.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:40 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
expires: Wed, 24 Nov 2021 11:49:40 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame EF98 4 KB
649 B 29ms
15ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900019.redintelligence.net
URL: https://hal900019.redintelligence.net/request_content.php?s=42655700085917500951393011788019&a=e05e8d31

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ad246d47536dacf0256646042ec184678bfc630fcb638d9199bd66cf8cb5e457

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900019.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 10:16:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Nov 2021 11:49:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Nov 2021 11:49:40 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame EF98 14 KB
14 KB 5ms
2ms Image
image/png 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/49107/creativesup/forever_young_strunz_reachgroup_1200x627.jpg
Requested by: Host: hal900019.redintelligence.net
URL: https://hal900019.redintelligence.net/request_content.php?s=42655700085917500951393011788019&a=e05e8d31
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 2fab929264718d886e2784c5abb4243cb4e2cab36a74fb3bbc525550149d2d7d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900019.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:40 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 14280
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame EF98 16 KB
16 KB 5ms
2ms Image
image/png 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/62726/creativesup/ESDE_MSS_Step2_Kleid_1200x627_251021_rs-IxQ56xIE.jpg
Requested by: Host: hal900019.redintelligence.net
URL: https://hal900019.redintelligence.net/request_content.php?s=42655700085917500951393011788019&a=e05e8d31
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 9f596e9f70b25aff0b02bd727d1be779873d9c7696aa58d86f5a6a546c146b54

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900019.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:40 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16239
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame EF98 16 KB
16 KB 8ms
2ms Image
image/png 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52085/creativesup/affiliate-panini-familienzeit-banner-1200x627.jpg
Requested by: Host: hal900019.redintelligence.net
URL: https://hal900019.redintelligence.net/request_content.php?s=42655700085917500951393011788019&a=e05e8d31
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 3fe48d40a8c4c05157c0eb8ccccc8ddb6b3fba1a85443a5a47d6fddfa203820f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900019.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:40 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16145
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 6DA3 35 B
463 B 36ms
9ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJom0Pn96mnn2tkSEZwP6PI&google_cver=1&google_push=AYg5qPK-iiTk1GaRbgZm7yCjL_Jt2QqghreIr75ymCWELZojsRZYGp1veTO967Yy4tZHDbJoetgARDnohLyok3rNvgXt1TCKNWBw

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6DA3
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEJtpmtp15172e_KNmzrQQxc&google_cver=1&google_push=AYg5qPJn37uec2ruRleGXofU-PCdK4WWEw_m-fsTfu9UBoMM5HSxnfJVbqG_WBQlvMEe3li7jDyDNwLQ4Qs14gMWrBXZHvllvUZX
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJn37uec2ruRleGXofU-PCdK4WWEw_m-fsTfu9UBoMM5HSxnfJVbqG_WBQlvMEe3li7jDyDNwLQ4Qs14gMWrBXZHvllvUZX&google_hm=Q0FFU0VKdHBtdHAxNTE3M...

170 B
188 B

16ms
16ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJn37uec2ruRleGXofU-PCdK4WWEw_m-fsTfu9UBoMM5HSxnfJVbqG_WBQlvMEe3li7jDyDNwLQ4Qs14gMWrBXZHvllvUZX&google_hm=Q0FFU0VKdHBtdHAxNTE3MmVfS05tenJRUXhj

Requested by

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 24 Nov 2021 11:49:40 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJn37uec2ruRleGXofU-PCdK4WWEw_m-fsTfu9UBoMM5HSxnfJVbqG_WBQlvMEe3li7jDyDNwLQ4Qs14gMWrBXZHvllvUZX&google_hm=Q0FFU0VKdHBtdHAxNTE3MmVfS05tenJRUXhj
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6DA3
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPI_L0m2o12koi6ct3PGxX3rRk4Uo00RQWOlfs-1oiPvQ66W18ie7ZfHtp1WfNGPQqvfR8r0cIgBl3UDQHUlgDERV_1kppdn&google_gid=CAESEPmaMAbRgnwj2Foi2VTeEk0&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCNTN-IwGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBJX0wwbTJvMTJrb2k2Y3QzUEd4WDNyUms0VW8wMFJRV09sZnMtMW9pUHZRNjZXMThpZTdaZkh0cDFXZk5HUFFxdmZSOHIwY0lnQmwzVURRSF...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQ0s5YWRUbnI0U0tEQ0lGeGQ1VWwxcXZRNXF3bUt6TmJXTnVaLTJCZ2FYMA==&google_push

170 B
188 B

16ms
16ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQ0s5YWRUbnI0U0tEQ0lGeGQ1VWwxcXZRNXF3bUt6TmJXTnVaLTJCZ2FYMA==&google_push

Requested by

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 24 Nov 2021 11:49:40 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQ0s5YWRUbnI0U0tEQ0lGeGQ1VWwxcXZRNXF3bUt6TmJXTnVaLTJCZ2FYMA==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6DA3
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mYR_0lxkSSGHfzG-Mtu8bQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
17ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mYR_0lxkSSGHfzG-Mtu8bQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKeAcgXMEm4NzzzbnGEnZTGb-oxEI9ycFJNsFCSBVns4UvVzi8HQdoMzMI6B3MddkKr-xhkPwtLoJKw7YseW3NC2krVVYA

Requested by

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mYR_0lxkSSGHfzG-Mtu8bQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKeAcgXMEm4NzzzbnGEnZTGb-oxEI9ycFJNsFCSBVns4UvVzi8HQdoMzMI6B3MddkKr-xhkPwtLoJKw7YseW3NC2krVVYA
date: Wed, 24 Nov 2021 11:49:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6DA3
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEItMzUY5wjXQAA4L4nddjs8&google_cver=1&google_push=AYg5qPLnJginBBGKj7FO_FpJs7S6Pjh1htNLx6XLqz506cPkeQYN5q8zBgCN2wklIpI7Ry_vYaW...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dER1NIUlYtMU4tQzk3Rw==&google_push=AYg5qPLnJginBBGKj7FO_FpJs7S6Pjh1htNLx6XLqz506cPkeQYN5q8zBgCN2wklIpI7Ry_vYaWJNW-biWGAjWtDr9yeZpw06L4

170 B
188 B

18ms
18ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dER1NIUlYtMU4tQzk3Rw==&google_push=AYg5qPLnJginBBGKj7FO_FpJs7S6Pjh1htNLx6XLqz506cPkeQYN5q8zBgCN2wklIpI7Ry_vYaWJNW-biWGAjWtDr9yeZpw06L4

Requested by

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dER1NIUlYtMU4tQzk3Rw==&google_push=AYg5qPLnJginBBGKj7FO_FpJs7S6Pjh1htNLx6XLqz506cPkeQYN5q8zBgCN2wklIpI7Ry_vYaWJNW-biWGAjWtDr9yeZpw06L4
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 6DA3
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAq...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 6DA3 43 B
297 B 397ms
93ms Image
image/gif 2600:1f18:445b:903:f033:2332:bd20:fe7f
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEK2YU_TFwXyDq82218vQEwI&google_cver=1&google_push=AYg5qPKu-TTC6ISWLqiN8gJ_1NrIBbDaZTmu9ZUI3v6xTTleo54j1hOjXEfe6Tplpl6ZQctKdZGF79eoVc5ivyrDbdQVsfPdJDlc
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=8489995635&adk=3434802048&adf=3656457494&pi=t.ma~as.8489995635&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579183&bpp=4&bdt=270&idt=112&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=8687902763839&frm=20&pv=2&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClepEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZfWoh0Xf5f&p=https%3A//www.save70.com&dtd=133
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:445b:903:f033:2332:bd20:fe7f Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6DA3 0
12 B 32ms
17ms Image
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JgymGqNfuI1vR_2u8TvbjfurDju5U7ALGwpx735Pg5qEnH54sfaQl_2mvHue32u6kheRiZ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal900019.redintelligence.net/ Frame EF98 0
150 B 6ms
3ms Script
text/html 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900019.redintelligence.net/viewability?s=42655700085917500951393011788019&a=5f22f3b8&vb=m
Requested by: Host: hal900019.redintelligence.net
URL: https://hal900019.redintelligence.net/request_content.php?s=42655700085917500951393011788019&a=e05e8d31
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900019.redintelligence.net/request_content.php?s=42655700085917500951393011788019&a=e05e8d31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 24 Nov 2021 11:49:40 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 dc_pre=COrB65_3sPQCFU8eBgAdaysEwg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237
adservice.google.com/ddm/fls/z/ Frame 4750 42 B
63 B 57ms
43ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=COrB65_3sPQCFU8eBgAdaysEwg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=COrB65_3sPQCFU8eBgAdaysEwg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5170312458197.237?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame CEC2 51 KB
51 KB 46ms
8ms Script
application/javascript 143.204.98.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3392345&wgcampaignid=99582&viewref=42655700085917500951393011788019&js=1&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-127.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id: wvDglZsFnxZ0eZ1mUErJkFMo1VNidWYJ
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Tue, 09 Nov 2021 11:05:10 GMT
server: AmazonS3
age: 23818
etag: "ec0ced40cbb5211db06b8a36f209e442"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Wed, 24 Nov 2021 05:13:10 GMT
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 51794
x-amz-cf-id: fWdcfAe9GORPtJbnWu7-Aoycb0QV1vvmQWjtqG1DmFjZwsnuEBrWIQ==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame CEC2 160 B
618 B 113ms
41ms Image
image/jpeg 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=35419500083638600710786011788008&wglinkid=3392345
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=8489995635&adk=3434802048&adf=3656457494&pi=t.ma~as.8489995635&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579183&bpp=4&bdt=270&idt=112&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=8687902763839&frm=20&pv=2&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7ClepEr%7C&abl=CS&pfx=0&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&xpc=ZfWoh0Xf5f&p=https%3A//www.save70.com&dtd=133
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 6b71d2bd27010cbb01e505314423d9c903230bf4182019eb1ca8016bd2b624a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 24 Nov 2021 11:49:40 GMT
Last-Modified: Wed, 24 Nov 2021 11:49:40 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/jpeg
Content-Length: 160
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 548bdb63b969e5c27f75e62faf543d70.js Show response
www.gstatic.com/mysidia/ Frame E243 7 KB
4 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/548bdb63b969e5c27f75e62faf543d70.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=5536529239&adk=744374605&adf=3700167759&pi=t.ma~as.5536529239&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579187&bpp=1&bdt=274&idt=136&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=8687902763839&frm=20&pv=1&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1100&ady=1145&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=NXrK5Vwp92&p=https%3A//www.save70.com&dtd=139

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

541a22e85f3238899f2589d44b9390a8d6d6e193a5d436c10e8ec9ce7b256e76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:03:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53199
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3286
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 21 Feb 2022 21:03:01 GMT

GET
H2 200 57a53ef409095c62d62662153513db7d.js Show response
www.gstatic.com/mysidia/ Frame E243 132 KB
48 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/57a53ef409095c62d62662153513db7d.js?tag=video_mra/web_raspberry

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be34ec9a0775d1541c4e659182d9ccf42e3a4671de5ec3235aa4ed11e7e0117c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 22 Nov 2021 21:32:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137830
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49541
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 20 Feb 2022 21:32:30 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame E243 3 KB
579 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 24 Nov 2021 10:04:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 24 Nov 2021 11:49:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 24 Nov 2021 11:49:40 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame E243 1 KB
880 B 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 959
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Dec 2021 11:33:41 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame E243 19 KB
8 KB 23ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:46:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Dec 2021 11:46:41 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame E243 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:47:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 137
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Dec 2021 11:47:23 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E243 119 KB
36 KB 30ms
16ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 24 Nov 2021 11:49:40 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame E243 15 KB
6 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:45:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 237
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Dec 2021 11:45:43 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E243 0
0 15ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQhEmC8ALObIVsWd5TtEPiTTRT-mNqOkH1DyUjr9IHUi4ML6Kovo2l8gMSZKpmVRHtobjeCku9VlvgUAF9D5trHShvWog
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=5536529239&adk=744374605&adf=3700167759&pi=t.ma~as.5536529239&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579187&bpp=1&bdt=274&idt=136&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=8687902763839&frm=20&pv=1&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1100&ady=1145&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=NXrK5Vwp92&p=https%3A//www.save70.com&dtd=139
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 163b3e9c260ab6fd774ac5b5c6fd1d76.js Show response
www.gstatic.com/mysidia/ Frame E243 27 KB
11 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:03:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53198
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11360
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 21 Feb 2022 21:03:02 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13991095440182360674/ Frame E243 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13991095440182360674/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b18aa2ac0b6cf29f1a9934679c843b31eb1b5b08471e9a8ebbb02f607be2ff86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 23:49:39 GMT
x-content-type-options: nosniff
age: 43201
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1628
x-xss-protection: 0
last-modified: Wed, 19 May 2021 13:43:48 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 23 Nov 2022 23:49:39 GMT

GET
DATA 200
OK truncated
/ Frame E243 216 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81cacd6b187878c8eb795e61e66c648ee76c410dafc63852de35290c1e56f9f1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H2 204 csi
csi.gstatic.com/ Frame E243 0
327 B 315ms
106ms Ping
image/gif 2607:f8b0:4006:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kwdgsi0h&c=6043329228344&slotId=3021664614172&qqid=CJCgup_3sPQCFUwOGwodB0EA_A&sei=44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=rda&ulv=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/57a53ef409095c62d62662153513db7d.js?tag=video_mra/web_raspberry
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80a::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/7258307382913594386/ Frame E243 110 KB
110 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7258307382913594386/downsize_200k_v1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ec50fd5f8d5b6274cb2954bc6ac372080a49b93ebcb0ff6f1cba4f1602501fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 12:49:31 GMT
x-content-type-options: nosniff
age: 514809
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112173
x-xss-protection: 0
last-modified: Thu, 18 Nov 2021 10:26:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 18 Nov 2022 12:49:31 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E243 0
0 54ms
53ms Fetch
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CY5tj0yaeYdDqFcycbIeCgeAPlbytwWbv_sCb9w6sw9X_hBwQASDSwedBYJX68IGMB6AB2IXR4wPIAQmpAnn1zcwl3rI-qAMByAPLBKoE4gFP0B37VP7I0ShE0tE8tgsvRMSsOJKH7NNLtjL4FpTpldvknRT0IYK--yPRecyclCqaq5HzFqeLJvWotDqwWNlrjxqVQ8LhAfP1puBzv87ljFlvHlEOER9IRTCaLWe1283N7_7ohdkPWf6c9mMIV3rnjV1-254E9q6n8Gl_eEdYe0MfIjj65QuhuR80vePSAFaWNrPdbHr0fpPjQqdU9a_wr3wUGevp_Qmjofil8q_VkM28ANFhuLNTI3xpUBDBzBkQPiomNPv9hOJwDKBYFZopd5AlijdWacb1IUDMAnclsC8xwATQs-HE5QOSBQQIBBgBkgUECAUYBKAGLoAHkPquHKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEJ_gGtIICQiA4YAQEAEYX4AKAcgLAdgTDdAVAZgWAYAXAbIXHAoaCAASFHB1Yi0zMDQ5NTI2MDI1Mjk4ODY5GAA&sigh=xeQQOrv3TEA&uach_m=[UACH]&template_id=3484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=5536529239&adk=744374605&adf=3700167759&pi=t.ma~as.5536529239&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579187&bpp=1&bdt=274&idt=136&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=8687902763839&frm=20&pv=1&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1100&ady=1145&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=NXrK5Vwp92&p=https%3A//www.save70.com&dtd=139
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 24 Nov 2021 11:49:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 206
Partial Content videoplayback
rr4---sn-4g5e6nsz.googlevideo.com/ Frame E243 576 KB
577 KB 52ms
8ms Media
video/mp4 2a00:1450:4001:5f::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr4---sn-4g5e6nsz.googlevideo.com/videoplayback?expire=1637783380&ei=1CaeYYiGFoXX1wbyqbzADQ&ip=2a01:4f8:212:78e:2c::1&id=c797ade4caa36175&itag=18&source=youtube&requiressl=yes&mh=Wb&mm=31&mn=sn-4g5e6nsz&ms=au&mv=m&mvi=4&pl=51&susc=gvp&acao=yes&ctier=L&mime=video/mp4&vprv=1&dur=15.069&lmt=1637225747472028&mt=1637754303&txp=6210222&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,vprv,dur,lmt&sig=AOq0QJ8wRgIhAJ5jSlmJw4BcqwJWFAf8x1drEdJ6bxuto8kASq8VGzIHAiEAlyJBA2tK5v0NT6eLmBcuHZXu1jHrBYhLmnRoIr0GkMQ=&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRQIhAOMIxo_pHJDtM2At9QUMNBKHwZl-bcZWJoQuMbNMo1chAiAEAMlFRcyaKvoA2qKguxDFJeYs7Mr9KV0aj3t017O6bQ==&cpn=gQAf5rxT3wSFFTL8

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:5f::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

c80e89f43b9c32aa9597e36fd1f22d3cdff6415731d250f091ac3a390f9defd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Range: bytes=0-

Response headers

Date: Wed, 24 Nov 2021 11:49:40 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 18 Nov 2021 08:55:47 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-589982/589983
Cache-Control: private, max-age=28500
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 589983
Expires: Wed, 24 Nov 2021 11:49:40 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A0AB 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 24 Nov 2021 05:53:44 GMT
expires: Thu, 25 Nov 2021 05:53:44 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 21356
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame E243 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ab2baffa27c0b31fd237668048ec629f2edbd2ad5893c238afad699ccce75155

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame E243 21 KB
21 KB 25ms
11ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 22 Nov 2021 18:21:26 GMT
x-content-type-options: nosniff
age: 149294
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:08:24 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 22 Nov 2022 18:21:26 GMT

GET
H3 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame E243 21 KB
21 KB 19ms
8ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 16:54:46 GMT
x-content-type-options: nosniff
age: 68094
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:07:18 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 23 Nov 2022 16:54:46 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0AB
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMIM-oDCHogYor0HtRSlkS4&google_cver=1&google_push=AYg5qPJo175omUlWE7bv5U1e4bQbeL1wl0FFzEj83x1BO97BkzFKNo1gZP...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJo175omUlWE7bv5U1e4bQbeL1wl0FFzEj83x1BO97BkzFKNo1gZPWMpVPbEg6Ty4F_KEdZvIgxjxugjyvDRgV4zQF7gVw&google_hm=XxgKk1o...

170 B
188 B

17ms
17ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJo175omUlWE7bv5U1e4bQbeL1wl0FFzEj83x1BO97BkzFKNo1gZPWMpVPbEg6Ty4F_KEdZvIgxjxugjyvDRgV4zQF7gVw&google_hm=XxgKk1ofwRGACKNyB8ugsA

Requested by

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJo175omUlWE7bv5U1e4bQbeL1wl0FFzEj83x1BO97BkzFKNo1gZPWMpVPbEg6Ty4F_KEdZvIgxjxugjyvDRgV4zQF7gVw&google_hm=XxgKk1ofwRGACKNyB8ugsA
pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0AB
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJokkJwKcMu4cEojBHh58WC1M9EqTyKor4BaU9...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVo0bTFBQUFCSTlZM2tyLQ&google_push=AYg5qPJokkJwKcMu4cEojBHh58WC1M9EqTyKor4BaU9ZKTmPf8z-ToOLTDbWwCZt5yePSVCix7RSpLROLSC8jP3v6e5ytEZAd34

170 B
188 B

33ms
32ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVo0bTFBQUFCSTlZM2tyLQ&google_push=AYg5qPJokkJwKcMu4cEojBHh58WC1M9EqTyKor4BaU9ZKTmPf8z-ToOLTDbWwCZt5yePSVCix7RSpLROLSC8jP3v6e5ytEZAd34

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVo0bTFBQUFCSTlZM2tyLQ&google_push=AYg5qPJokkJwKcMu4cEojBHh58WC1M9EqTyKor4BaU9ZKTmPf8z-ToOLTDbWwCZt5yePSVCix7RSpLROLSC8jP3v6e5ytEZAd34
Date: Wed, 24 Nov 2021 11:49:40 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 466606.gif
id.rlcdn.com/ Frame A0AB 42 B
318 B 17ms
14ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPItfeTgztoqBDO_U0zmwVCpUF6YnWwXuz0WBhcuyudo0hqSOnXyXwPs5U9ApKg0DxrVsSfOSylj_U-s_uPZykGL6Bj0SO4&google_gid=CAESEKTPY3KCPgyGgf_Ty9JukvI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3049526025298869&output=html&h=250&slotname=5536529239&adk=744374605&adf=3700167759&pi=t.ma~as.5536529239&w=300&lmt=1637754579&psa=0&format=300x250&url=https%3A%2F%2Fwww.save70.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637754579187&bpp=1&bdt=274&idt=136&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=300x250&correlator=8687902763839&frm=20&pv=1&ga_vid=644411650.1637754579&ga_sid=1637754579&ga_hid=1367345673&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1100&ady=1145&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=4361073289980788&pem=631&tmod=1484715730&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=NXrK5Vwp92&p=https%3A//www.save70.com&dtd=139
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Nov 2021 11:49:40 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0AB
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEPxyKH1_1I2F-TVkxTrYzZk&google_cver=1&google_push=AYg5qPITp3s3Oj-FxJfSp4-BpTfCvzkKBPji9yYRnb3pmA_gZnMjv22tYtlcediBAEIBfiUabD_uOakOmOJLX4BwUWQGeNMd8B8
https://rtb.openx.net/sync/dds?google_gid=CAESEPxyKH1_1I2F-TVkxTrYzZk&google_cver=1&google_push=AYg5qPITp3s3Oj-FxJfSp4-BpTfCvzkKBPji9yYRnb3pmA_gZnMjv22tYtlcediBAEIBfiUabD_uOakOmOJLX4BwUWQGeNMd8B8&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPITp3s3Oj-FxJfSp4-BpTfCvzkKBPji9yYRnb3pmA_gZnMjv22tYtlcediBAEIBfiUabD_uOakOmOJLX4BwUWQGeNMd8B8&google_hm=81J-2TQgx3E2l1gLPz5lbQ==

170 B
188 B

17ms
16ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPITp3s3Oj-FxJfSp4-BpTfCvzkKBPji9yYRnb3pmA_gZnMjv22tYtlcediBAEIBfiUabD_uOakOmOJLX4BwUWQGeNMd8B8&google_hm=81J-2TQgx3E2l1gLPz5lbQ==

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:39 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPITp3s3Oj-FxJfSp4-BpTfCvzkKBPji9yYRnb3pmA_gZnMjv22tYtlcediBAEIBfiUabD_uOakOmOJLX4BwUWQGeNMd8B8&google_hm=81J-2TQgx3E2l1gLPz5lbQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: idlcsjei0sgjkp9sgjc6cis8vb862561

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0AB
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mYR_0lxkSSGHfzG-Mtu8bQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
17ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mYR_0lxkSSGHfzG-Mtu8bQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKYqTfTRJNsWHTC-_zETIFGnZm_jRgsLdDJmba5bU2Ibvg2spzctg7aJwFpyFZfVUjHJ2ji73ga3X0Jp8cMGHTQU8rkZjE

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mYR_0lxkSSGHfzG-Mtu8bQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKYqTfTRJNsWHTC-_zETIFGnZm_jRgsLdDJmba5bU2Ibvg2spzctg7aJwFpyFZfVUjHJ2ji73ga3X0Jp8cMGHTQU8rkZjE
date: Wed, 24 Nov 2021 11:49:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0AB
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFwqoBNMo622rLNdR2BoovY&google_cver=1&google_push=AYg5qPJQCUKk0cisV070Q1K9wL24hSdCyIXB6NwAz2aAwve2cIXVjJTEANqF5AMJV_bqmra_uDH...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dER1NJMkgtMUEtTDNKWQ==&google_push=AYg5qPJQCUKk0cisV070Q1K9wL24hSdCyIXB6NwAz2aAwve2cIXVjJTEANqF5AMJV_bqmra_uDHJGrdySaCi9Sh2DRLf0mOg-KE

170 B
188 B

17ms
17ms

Image
image/png

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dER1NJMkgtMUEtTDNKWQ==&google_push=AYg5qPJQCUKk0cisV070Q1K9wL24hSdCyIXB6NwAz2aAwve2cIXVjJTEANqF5AMJV_bqmra_uDHJGrdySaCi9Sh2DRLf0mOg-KE

Requested by

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dER1NJMkgtMUEtTDNKWQ==&google_push=AYg5qPJQCUKk0cisV070Q1K9wL24hSdCyIXB6NwAz2aAwve2cIXVjJTEANqF5AMJV_bqmra_uDHJGrdySaCi9Sh2DRLf0mOg-KE
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame A0AB
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A0AB 0
12 B 15ms
14ms Image
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JRZN1WT89FLrKKeyFa7RpdRUX9N0No58PoU3ol9tN1-ZYcyNFkNpzzB0jSjY1cVugx5Wrn

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:40 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
9 KB 38ms
21ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211111&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bae975b0fc84f1e4f02b54c98b552488635df2bc0cb7f50bf4ad5ae40a851dc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 24 Nov 2021 11:49:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9325
x-xss-protection: 0

GET
H3 200 W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response
pagead2.googlesyndication.com/bg/ Frame D5B3 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:27:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1306
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13296
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 11:27:54 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 1139ms
1139ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Wed, 24 Nov 2021 11:49:41 GMT

GET
H2 204 unip Show response
trc-events.taboola.com/1028252/log/3/ 0
246 B 40ms
12ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1028252/log/3/unip?en=pre_d_eng_tb&tos=1639&scd=41&ssd=1&est=1637754579125&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1637754580764&vi=1637754579123&ri=4d7f3ca36bafb451545ff0cbaf44fa1b&ref=null&cv=20211114-1-RELEASE&item-url=https%3A%2F%2Fwww.save70.com%2F
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1028252/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: https://www.save70.com
pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 unip Show response
trc-events.taboola.com/1072627/log/3/ 0
245 B 40ms
12ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1072627/log/3/unip?en=pre_d_eng_tb&tos=1640&scd=41&ssd=1&est=1637754579125&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1637754580765&vi=1637754579123&ri=91045aa5f5064ad45b77e2045d41d958&ref=null&cv=20211114-1-RELEASE&item-url=https%3A%2F%2Fwww.save70.com%2F
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1028252/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: https://www.save70.com
pragma: no-cache
date: Wed, 24 Nov 2021 11:49:40 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

POST
H/1.1 200
OK trk.php Show response
action.metaffiliation.com/ Frame CEC2 818 B
3 KB 117ms
37ms Fetch
application/json 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to

Full URL: https://action.metaffiliation.com/trk.php
Requested by: Host: img.metaffiliation.com
URL: https://img.metaffiliation.com/na/na/res/trk/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash: e64225074a618ae26463e9b3809011fda4ea774e6c3cfcd7b787eac8b1e1c413

Request headers

x-kwanko-sdk-version: web-1.16
Referer: https://googleads.g.doubleclick.net/
x-kwanko-content-type: application/json
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryESFwwUMvVWVv1ZoN

Response headers

Date: Wed, 24 Nov 2021 11:49:41 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR CUR ADMa PSAa OUR IND NAV COM",policyref="http://www.netaffiliation.com/w3c/p3p.xml"
X-TRK-D: 0.0069699287414551
Connection: close
Pragma: no-cache
X-TRK-PROC: 73241
Last-Modified: Wed, 24 Nov 2021 11:49:41 GMT
Server: nginx
X-TRK-DECISION: 2
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
X-TRK-SRV: 9

OPTIONS
H/1.1 204
No Content trk.php
action.metaffiliation.com/ Frame 0
0 109ms
30ms Preflight
text/plain 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to

Full URL: https://action.metaffiliation.com/trk.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-kwanko-content-type,x-kwanko-sdk-version
Origin: https://googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: nginx
Date: Wed, 24 Nov 2021 11:49:40 GMT
Content-Type: text/plain charset=UTF-8
Content-Length: 0
Connection: close
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Max-Age: 1728000

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame CEC2 16 B
232 B 94ms
94ms Fetch
application/json 54.75.239.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.75.239.54 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-75-239-54.eu-west-1.compute.amazonaws.com

Software

nginx / PHP/7.4.25

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 24 Nov 2021 11:49:41 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.25
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 113ms
31ms Preflight 54.75.239.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.75.239.54 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-239-54.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://googleads.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 24 Nov 2021 11:49:41 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame CEC2 43 B
910 B 52ms
16ms Image
image/gif 85.14.248.91
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=8&extPu=esprit-dcm&extLi=25444971&extPm=319075961&extCr=&rnd=%n&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_312}

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.14.248.91 Kamp-Lintfort, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mi, 24 Nov 2021 11:49:41 GMT
Server: Microsoft-IIS/8.5
Date: Wed, 24 Nov 2021 11:49:40 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1788
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 img_5_1_1.gif
img.metaffiliation.com/12/73241/ Frame CEC2 8 KB
7 KB 9ms
9ms Image
image/gif 192.229.220.129
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.metaffiliation.com/12/73241/img_5_1_1.gif
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.220.129 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FE7) /
Resource Hash: a2b3c5cd0c329c390fe6c10f7f4d3e83f67fc81657ebe7daebb89ee6821cc738

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:49:41 GMT
content-encoding: gzip
last-modified: Thu, 04 Nov 2021 08:57:40 GMT
server: ECAcc (frc/8FE7)
age: 2209
etag: "6183a084-1e58"
vary: Accept-Encoding
x-cache: HIT
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=600, s-maxage=3600
accept-ranges: bytes
content-length: 7502

POST
H3 204 csi
csi.gstatic.com/ Frame E243 0
17 B 207ms
106ms Ping
image/gif 2607:f8b0:4006:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~kwdgsi0n&c=6043329228344&slotId=3021664614172&qqid=CJCgup_3sPQCFUwOGwodB0EA_A&umsem=0&ape=1&ple=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/57a53ef409095c62d62662153513db7d.js?tag=video_mra/web_raspberry
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80a::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:41 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 682F 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Wed, 24 Nov 2021 11:36:32 GMT
expires: Thu, 24 Nov 2022 11:36:32 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 789
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F2EE 783 B
533 B 26ms
26ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

41fc860f3b57f62cd927ab8828969b1db505c7b39cf723a6ef3b2b439509cd9b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2Numk/PTLML8gEotUi3DJg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Wed, 24 Nov 2021 11:49:41 GMT
date: Wed, 24 Nov 2021 11:49:41 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-2Numk/PTLML8gEotUi3DJg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response
pagead2.googlesyndication.com/bg/ Frame 682F 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 11:27:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1307
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13296
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 11:27:54 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame F2EE 0
0 47ms
47ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211111&jk=4361073289980788&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20211111&jk=4361073289980788&bg=!09Cl0JTNAAZQLpa_UC47ACkAdvg8WmWumEV9q3B480P0NaolYV26lE4ahBmOhnZYOue8yZ4QYTdQHwIAAABUUgAAAAxoAQcKAB4jwJ3UYluruFLxG-zW9tGLLVkYa7C4CZMcXow3FZiZAobyGqk0Ucg35382wcooIbQYxxlr4Dt-201YatUtgwAW6d7qpZomTFmUxx9SKI0yCd3OQnWl8zGzqk-HOsfdXCnDGE8YF5f8kJRVQX5a656rm0aHAqiWJ7Pyvl7W4hkaKKerxnLfTkiyPHrfSIWj3HwF4tOIs2ZTWSPz_pecGrRzXcODRz52xtCkKS3iZsXpiDNak2fRbepT69lQEkxBxPSPxrTEDapQfMdC3fVUdjVgXpgohMygTXBPNHf3NRTjpwZJ7aev4woX5z78utXwwL9DDInZHIeOtIwmMejNNLzVOeKuOtMMmTGgeD3-HiAEbRFUt7e04UbWrAmHFb5F8RstGol-XJXxL-Xo9wurLm5pj2RxiwJ3S2N0BPR4QiZRzFuxoQRrpAqZtzy5BvIbotg1JHmOvQvl5M4ZPgUxIf8yIOey0YW4E6EVC0UMRP8Yj1_utZYKcfR4ViudGb7TSOrvEHFeRVEMa7emuboKp0wypWnWm8eLQDqSu4Nv24qDIVwr-6u_ThZLiyUOL6EUO1HDmJQZI31w4460pDyZtpPh7MiT_vEHFOp_eSl35TlW1lISW1dhlaU6zx6xqqpm2ki-WBTsIPrMaeXQEeKZ2u0VOKoP1mpJr0mZFA9VkBUni6SATiXCcTS6HTiF0_IFppdD8CINHt286ccKFdjmJ7_4S8RH-2ViBHDgTFjeumaWdYQFzxnbElrE29I5UFA61K8nvzL9mLqtb7ikZ8Tl4Y_FwQYTs5Nsd3mRO0pyU8mlrnBWpQU2wixlbACqqpgqcfbhjkzPZ-CgXGO10pf7EO3WrPXeG_hasI7_u8HogBR8NHz4H01UV0P-hduC3DdBcZXjAs-G_szk

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 24 Nov 2021 11:49:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 unip Show response
trc-events.taboola.com/1028252/log/3/ 0
245 B 12ms
12ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1028252/log/3/unip?en=pre_d_eng_tb&tos=4641&scd=41&ssd=1&est=1637754579125&ver=35&isls=true&src=i&invt=3000&rv=1&tim=1637754583766&vi=1637754579123&ri=4d7f3ca36bafb451545ff0cbaf44fa1b&ref=null&cv=20211114-1-RELEASE&item-url=https%3A%2F%2Fwww.save70.com%2F
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1028252/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: https://www.save70.com
pragma: no-cache
date: Wed, 24 Nov 2021 11:49:43 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 unip Show response
trc-events.taboola.com/1072627/log/3/ 0
245 B 12ms
12ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1072627/log/3/unip?en=pre_d_eng_tb&tos=4642&scd=41&ssd=1&est=1637754579125&ver=35&isls=true&src=i&invt=3000&rv=1&tim=1637754583767&vi=1637754579123&ri=91045aa5f5064ad45b77e2045d41d958&ref=null&cv=20211114-1-RELEASE&item-url=https%3A%2F%2Fwww.save70.com%2F
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1028252/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.save70.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: https://www.save70.com
pragma: no-cache
date: Wed, 24 Nov 2021 11:49:43 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc

Verdicts & Comments Add Verdict or Comment

160 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

49 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.save70.com/	1970-01-20 07:41:23	Name: visid_incap_1687058 Value: NrjYfu2+QYmBTCcxqfuJ0dImnmEAAAAAQUIPAAAAAADv8GFwtMj2esnJrpyzpLiE
.save70.com/	1969-12-31 23:59:59	Name: incap_ses_1214_1687058 Value: 4fsaBhqE6yYzWxDm/v7YENImnmEAAAAAHs6NOySX/1MUpf33j/hKgA==
www.save70.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4o7jikl5kab6m17898i04vd1rd
.save70.com/	1969-12-31 23:59:59	Name: incap_ses_535_1687058 Value: jQN5DgHU1zK6i7YeKLRsB9ImnmEAAAAAG+NjGjlsvUc55VqIM1DY5g==
.bing.com/	1970-01-20 08:17:30	Name: MUID Value: 04F4C27B2AF46A14025FD2822B266B4B
.save70.com/	1970-01-19 22:57:20	Name: _uetsid Value: 9ab691104d1c11ec89c4df3802bf97e6
.save70.com/	1970-01-20 08:17:30	Name: _uetvid Value: 9ab68b904d1c11ec97c1d71608c30a12
.sojern.com/	1970-01-19 23:05:59	Name: adh Value: 1
www.save70.com/	1970-01-19 22:55:54	Name: ___utmvc Value: hHA3GX8Mh5BRI0szr0oPnJSuuAOrfx7bgaWkPo5/0qkvYILw5Z8ZFvyhG5LTOaJB6WTWFrXBeo4lQY+ZgmPojPoL5ewGsvd+TFTtRJQjjxsVcmkh+luc+KV3VOEDw1HyU3cc6kOGXLtzwlu94vquRGYQMdU3zR+NbVgWJRSi1eoAt6oh5Cjz6Gi1qnRTqkQMndmCzqdhi6Boq+nLns67qOeqUK3/SmapcqO+JpSiSz/rdCCNJt64qn22/NPZUlXfa+2Bm99Axkb9nhnuOR424OEa20upfmJ7eP73kCFwa1/ADZ4oPLaXFgmEOroCcrjymDo3k9RStC/Ze6wbTaDFKy0yPybhFFUpo/q4uWdubX5wpf4h7uORw4jJf/yEFE9pRn+pSzf9CIB8ZYCdOFt73EJ8vcZOomayfXCKc3Ia3cUNVpamPXSMPfW+YaPJMnO47KShC8/LNCe61yPnW7w0zwk6K929euGNyo3zCGCrb8oTIV2w7QPr5DX1rE/Z7rFkbQCuWaR0UDNxy5RnomYpIoxelc3JZa0jtpyeZ7KpcqZgpgIPvah3NjR+Qp4Tp7sF6gWdT6uRLwRdAtqP6YcEukuLWOjUpACbNFnyPlN4LFBh68Zl5Smw/YWMzsd2LkWvk31X59g8WCJIuZ+1ai+dUakk1Nrz4xHoWakyjX+VwR9XcBoxBPc0ORUbFM0ZU5WQlwcSfmlpUPofadsdoJm1CJCOw/LiE/c/rH5/X3d5Szz9IbBCP6E1mODAf7GkDDwZ5NaW+g2SkD9xkiNH05/fpErM3XIWKG0pE3bCad0i0hwD1k3ilEY7g44gS+3qsbFzVIDVtyqRM7FQLr9ayIfU2cBdgD5COjFOCc5Sq5qMdaCwMu+1a3ybFYRJjixQQJOxZ4tkAVqHkN9ElRZ+74Qom0hxQNOTtyP1RVZC/yKyxT8NMQON09n7X+DRCIRTggeC5pewJv9vIcriN5VvHKbIgZdr/BqKd0SwnXYpvYvNy5C1SJnV+55FcMs6nUNU9tc3hphuwy2XK+x7p2I4ZwehtUWv5+FbOS86KYpW/Q2EEGEGX9Ho+4i/D+36tWf5gx8j7Z8VzrhvrLgdNuXCJD3LXlMrzRNKNjfEKGOAl+ljlERK03RX0NrD5suqKv4On9Z09A95S13sr1n5XzlnzlMdVVUSXRwXo/qpinJmVsShVCYnXB2hn1slXp4W5t8oA0+k2duI/JaY2YD9EC0tXeCHMQRxQ44/dCjtjry9IuZhDQnsVL1RyCHSmGwiPQIpKF4cEcZfely6NAwHT5+otuIHaeqDmrq82vxQhYv7Ci8kEBtbohxpni07ZT4fTRjAdGz8N9N+Fa9W52CvvybiKEPfsv/aj3SpYWvILBFA56jI5ADEtd66tIEhkzqzJZDfqN3hFDdLxX+sX6isC65plGNsCKjyg3U5QA8bIPhN2CxgyacsyudyoElTer9dEQX+Vel1FLU4RT8QXqq4Loho+bGYfZIGwiTI7Lxltj+dVEqHq0cTyK9lEt+ySAo0l7oR+ElZ41OUEMMDSiDHIgNa8nSwfuQBHme5xZn5I8C2+lv5iRaZvSvElPPhjWI6z9XpecxJCjFRoa8OPztRtFAMtX3LoEzRX13HBlkdK5zkoECS0YBq7ZWu4v8FtqBkmaxwQ19Si1RlxP/aZ54g5fMarac1QOB1l35s7Up8XLNd9h3vgRNG2+PA35Uta6aMgV0Ggy02JmpRrDn5NmkPZMRttm62dy2WtHwSBrAwWMG2QwbxyAYxsUVTeI+u2H4sH3bR0ecbPEbid5VlHFP5g+HTj/8sd6DOKIriNR50VfM+AV7XZS9RM2LVylW2uuy8G3LweM9GBoLzCa4FxYRSrP8D01MrcUUMGMHfy20Ys0RRN/TxGklupH9phyfcwv9mbuqLbKZAikLsDxvCdeF95qpwCRupu+qf7PSHL46JZr1cXNNBUjNHGp8PYarZOwuJ6bu6nF6orGAUosyJ6nFBr1xcHs9XdgdCu02/kxuOf1JKIQeJjMAbmHakiLjvcQVz9GzM9O3vMXbEB1h7y9RNc1caCyKlH5Tz5JxnmPmgbMDe8iBqwOZr915qHhdIS8+JCQ1OaHpitF15M6N5ad94/krI7lfUx4XdEpqUEoK8K6jjIyIXoIbTY5V+ZFO2f97JjdvtxvYWIrvSNanycf4ff10sql+opvapJPbLU9whccDnN2XezL9mXE+sDlo9wSlbBJjHh9zT+z05XnTZqrgREtQEXprpYB56VRtN58b5qUDvxDruKlN0hngXVZRifPEITAVjWxxHnDmmls+rUtwv8v9LySFI5rbZdS2ctMJQN+JrIUbKCDgDrRxGHa8ObhSMUJtB3+IA3zV3TrxbNOGRcpjysn72O38Ul3srVkGOIpPNsxY2LK1Q9X1bFZ9pdbsC0rlfBmD6QQ2YnRJY4kbcxxAw/A3/7R/iwN4oQrLAO0vezfH68fHHShZjVFZbZ3ElH73BMUnXM9obUGtUCVO10pDoUcGYk24Qwq4715/yJs7jDgYW+a1xh3clNdbu3bx4W+22OWtFJNgTfyr/7JWVBk8cTHBoFGGO1PrF/MqFXQm/0JI/vYP/diIQIsgAmb/rvZl2CdU3gdjaSnBz1IfHRH0bkqkbHUHerjF8rRieMtNJpmQxaryatNYQPmwEbhfLWOoY3nmh20V45iqfxPgPLGRpZ2VzdD0xODUwNDIsMTg0OTE4LHM9OTY3OTY3YTE4NzgwNzY5NDc5YWQ5MzdjN2I5OWFiOGE5MTY5N2Y5NWEzYTk3Y2E5NjhhYTliOWE4Yzk4YWNhN2E0ODA5Yzk5ODBhODc1NmU=
.save70.com/	1970-01-20 01:05:30	Name: _gcl_au Value: 1.1.588263716.1637754579
.adnxs.com/	1970-01-20 01:05:30	Name: uuid2 Value: 3578895244101527089
.save70.com/	1970-01-20 16:27:06	Name: _ga Value: GA1.2.644411650.1637754579
.save70.com/	1970-01-19 22:57:20	Name: _gid Value: GA1.2.871876041.1637754579
.save70.com/	1970-01-19 22:55:54	Name: _gat_UA-42783156-1 Value: 1
.save70.com/	1970-01-20 08:17:30	Name: __gads Value: ID=bfc1d448790881aa-22ed997ff6cb00c5:T=1637754579:RT=1637754579:S=ALNI_MbgXx0CxhMLs2zzoYHGQquG33Rh2w
.sojern.com/	1970-01-20 07:41:30	Name: gid Value: CAESEPPSjMkEqmBvgNBG0hwfOzg
.sojern.com/	1970-01-20 07:41:30	Name: cid Value: 5a7ac969-2929-43f4-965a-6053d4a62cb2#1637712000000
.adsrvr.org/	1970-01-20 07:41:30	Name: TDID Value: 4c7d56d2-689a-4c1b-ae17-95ab8021b9a6
.sojern.com/	1970-01-20 01:05:30	Name: apnid Value: 3578895244101527089
.adsrvr.org/	1970-01-20 07:41:30	Name: TDCPM Value: CAEYBSABKAIyCwiOtZmi59KXOhAFOAE.
.sojern.com/	1970-01-19 23:39:06	Name: ttdid Value: 4c7d56d2-689a-4c1b-ae17-95ab8021b9a6
.save70.com/	1970-01-20 01:05:30	Name: _fbp Value: fb.1.1637754579646.1830282056
.mathtag.com/	1970-01-20 07:41:30	Name: uuid Value: afc5619e-26d3-4c01-8cb7-c73b4b58a6c3
.awin1.com/	1970-01-19 22:58:47	Name: awpv16160 Value: 296283\|1637754580\|9b3de2b0-4d1c-11ec-9d39-2236c0dc0c5d
.awin1.com/	1969-12-31 23:59:59	Name: AWSESS Value: 356171:2329635
.zenaps.com/	1970-01-19 22:58:47	Name: awpv16160 Value: 296283\|1637754580\|9b3de2b0-4d1c-11ec-9d39-2236c0dc0c5d
.zenaps.com/	1969-12-31 23:59:59	Name: AWSESS Value: 356171:2329635
.metaffiliation.com/	1970-01-20 00:22:18	Name: neta_ssc Value: 775ff3kz94gtg0o2foppwnz3tyh3
.metaffiliation.com/	1969-12-31 23:59:59	Name: netases_ssc Value: 775ff3kz94gtg0o2foppwnz3tyh3
.quantserve.com/	1970-01-20 01:05:30	Name: d Value: EFoBCQHmJIEA
.quantserve.com/	1970-01-20 08:26:08	Name: mc Value: 619e26d4-31e29-ef990-94b8c
.rlcdn.com/	1970-01-20 07:41:30	Name: rlas3 Value: ZJ0Im3urCxeXYIdg06f4Oj3/CvrNG+jW0DASvZdicTI=
.agkn.com/	1970-01-20 07:41:30	Name: ab Value: 0001%3AdvXKiEjjiuT2pcaCXUcORyLxfsBXsMnr
.agkn.com/	1970-01-20 07:41:30	Name: u Value: C\|0CEApMONUKTDjVAAAAAAAAQ13AQCAAQpAAAAAAA
.rlcdn.com/	1970-01-20 00:22:18	Name: pxrc Value: CNTN+IwGEgUI6AcQABIGCOndKhAA
m.exactag.com/	1970-01-20 01:05:30	Name: exactag_new_gk Value: e4327d2c0fdc49418fb4ce34698443c3%7c23.01.2022+11%3a49%3a40
m.exactag.com/	1970-01-20 03:15:06	Name: exactag_new_uk Value: 91e37e8fff9d496f9f4e072d5a21317c%7c
m.exactag.com/	1969-12-31 23:59:59	Name: session_session Value: 0d1705c5d6d443d19ea74863
.casalemedia.com/	1970-01-20 07:41:30	Name: CMID Value: YZ4m1M1P7n3P15QGgi8fhgAA
.casalemedia.com/	1970-01-20 01:05:30	Name: CMPS Value: 5234
.pubmatic.com/	1970-01-19 22:57:20	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 01:05:30	Name: KADUSERCOOKIE Value: 99847FD2-5C64-4921-877F-31BE32DBBC6D
.casalemedia.com/	1970-01-20 01:05:30	Name: CMPRO Value: 1169
.casalemedia.com/	1970-01-19 22:57:20	Name: CMST Value: YZ4m1GGeJtQA
.doubleclick.net/	1970-01-20 08:17:30	Name: IDE Value: AHWqTUk6AB4WRvf8n1Qr_xSkNfd6VqCJz-IiRdxnYABNIQhnELCRaXNyzgPjl3QzaAA
.innovid.com/	1970-01-20 01:05:30	Name: uuid Value: 583ba9f3-5d48-4dad-845f-df77a36c73bf-20211124 06:49:40
.openx.net/	1970-01-20 07:41:30	Name: i Value: ffa8cbbc-3421-41a8-8a35-dc5488006c2a\|1637754580
.metaffiliation.com/	1970-01-20 00:22:18	Name: kwknc_ssc Value: ds511e19571c9f151-NDI2NTU3MDAwODU5MTc1MDA5NTEzOTMwMTE3ODgwMTk%3D
.metaffiliation.com/	1969-12-31 23:59:59	Name: kwkncses_ssc Value: ds511e19571c9f151-NDI2NTU3MDAwODU5MTc1MDA5NTEzOTMwMTE3ODgwMTk%3D

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_cver=1&google_gid=CAESEAzvAKfRBS8jYxyfoWIjwug&google_push=AYg5qPIsJpxUhl0GEbbMOlLOWgtqZ4Mge4JAqoNioutWMcWPI2-PYT721iY1_1F7JyZAY3COMt4kGDbmpzJ_-Zhgg48r6gJVgvY Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZ4m1M1P7n3P15QGgi8fhgAABJEAAAAB&google_gid=CAESEF7fuEyHaJQMMbgwTXMykxs&google_cver=1&google_push=AYg5qPLI6zOw0MpErkDhoTiqS84kEgAczCUM5qAtVg6BP9m8eWj1yjb6CswM0AjkaLPpx4yvxORREYZWyZLig1-Wlz8TPoWhfRc Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
action.metaffiliation.com
adservice.google.com
adservice.google.de
ag.innovid.com
analytics.webgains.io
api.webgains.io
bat.bing.com
cdn.taboola.com
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
csi.gstatic.com
d.agkn.com
d265rl6yp58lzi.cloudfront.net
fcmatch.google.com
fcmatch.youtube.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hal9000.redintelligence.net
hal900019.redintelligence.net
ib.adnxs.com
id.rlcdn.com
image6.pubmatic.com
img.metaffiliation.com
m.exactag.com
match.adsrvr.org
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.mathtag.com
pixel.rubiconproject.com
pixel.sojern.com
rr4---sn-4g5e6nsz.googlevideo.com
rtb.openx.net
save70.com
stats.g.doubleclick.net
tags.mathtag.com
tpc.googlesyndication.com
track.webgains.com
trc-events.taboola.com
trc.taboola.com
www.awin1.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.save70.com
www.zenaps.com
cm.g.doubleclick.net
107.154.139.143
107.154.142.143
107.178.244.119
141.226.228.48
142.250.186.162
142.250.186.34
143.204.98.127
151.101.129.44
184.30.20.207
185.29.132.242
185.33.220.145
185.64.190.78
192.229.220.129
216.58.212.130
216.58.212.166
23.79.145.223
2600:1f18:445b:903:f033:2332:bd20:fe7f
2600:9000:2156:e00:1:c9ba:9380:21
2607:f8b0:4006:80a::2003
2620:116:800d:21:f916:5049:f87f:108e
2620:1ec:c11::200
2a00:1450:4001:5f::9
2a00:1450:4001:803::2002
2a00:1450:4001:80e::200e
2a00:1450:4001:810::200a
2a00:1450:4001:811::2001
2a00:1450:4001:811::2002
2a00:1450:4001:811::2003
2a00:1450:4001:812::2002
2a00:1450:4001:812::200e
2a00:1450:4001:827::2003
2a00:1450:4001:828::2004
2a00:1450:4001:828::2008
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
2a00:1450:4001:830::2003
2a00:1450:400c:c1b::9c
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
3.124.136.236
35.227.252.103
35.244.174.68
46.236.13.147
52.18.11.109
52.223.40.198
54.75.239.54
69.173.144.138
78.46.90.238
85.14.248.91
94.130.102.164
95.131.136.1
0004f78c83a4872b4cd2445955afbe9532286d70acab9b7f7f2b2b5e0559b4c4
02ccfd89151b3defcfac407ee8ceb1ba647ff915a9aa2a88edf8129d3b53f549
03c2f97b3702631aa80673b144c9555c753f40a69493206df05f6d7119db9808
07880bac04585b241a57f5826cc3ba254f58a14b5a1704561b11d9ca51f8144a
087d61da6ab1ca4ff1c5de94d14e964c73a99c9fc6cd7275f556c199e74463ef
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
0d33406d748b6f24a0cb72ac8ebd1409f87c77ece41164aad43b224d8fb24d9f
0de29f44d21c92de8222cfde8f48acf67877acc4ac93419e5364c5984b8d2fbf
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11a82ab5c0b6b2513628cbb8231cab20436c04825530639eac8a9b0af1f8b5bd
126e39056f0841be1e0d8764bfc456458b05e1b2c2cd1e04ab1fd3bb4d57aaa6
16b0243565348bfe19de119830f59c24f77935d36639dccca01d21a2747c3ae5
17ea292a2ef40111675528e938e0cd6972dcb96bcb889de5f265c37045a4c265
182c9431e1fb414573d47253a9c441ea7742ead6a1bc02ea4606b6cf94a640c1
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1ec50fd5f8d5b6274cb2954bc6ac372080a49b93ebcb0ff6f1cba4f1602501fd
20f9dc1b8566a371cc3e871516427ca49165c3c5ee486801240fe3e725da235c
242450ed72468ca61ba17fe1bc46f93f43825d577ab2c6fa5fe5aeb87990a1d9
281434186f02e4d8317bb94c8f374f56436b6ce187aab1a365f8572b948cae3b
2d43c04a2d2f68039cedc241e492503a5e0d93a2cafb3be130993b3e3dfd8d4a
2da5386d859fb6b2a3c43913dfcae2848fa338d4613e30c56213e93292decebe
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9
2fab929264718d886e2784c5abb4243cb4e2cab36a74fb3bbc525550149d2d7d
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
3613eeb49b277a6f396c1f5ecb5441c06420542afc211b8ea7b3ac9297a6d30d
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
3e1790a16d3a781f1e44db40f942b8b117117c7534c40b66edfd0ca3010b5cc7
3fe48d40a8c4c05157c0eb8ccccc8ddb6b3fba1a85443a5a47d6fddfa203820f
40c86ac6b4d6e23507014e7f39b7a71bc54f256e1fab9154bbc522e8a0591e8a
4112275fe878d4b037316a449f7516817d3c7da7839eb532b81c80b309b36df5
41fc860f3b57f62cd927ab8828969b1db505c7b39cf723a6ef3b2b439509cd9b
4213ee7d4632fbd788b1c5ec6c0b5a31df036191cc5008bd0332754662c3685c
4397efbc9d01dcb4383734712b4e2290bc238020932a38ab16d77ef680e48c7d
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f4524f7e1a87079bc50a64681f880ccf3e6f5db1ec5fc27949377532a3881da
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
541a22e85f3238899f2589d44b9390a8d6d6e193a5d436c10e8ec9ce7b256e76
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5733d6047e6b50698d0e4a71e99ce36e9065e8f62067050964d3ab1307e6d22d
5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266
5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274
62b8ca931da47566664fe3204915e230578d29eece27c17278a45c8e76717874
65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e
6a6dd6978e1f496391bb929b5736a6e056841050226d5da02e33e381576ede93
6b5b394190bf78592909ab9f0c97fcd974cfaaa6090784d86867c519cfadee86
6b71d2bd27010cbb01e505314423d9c903230bf4182019eb1ca8016bd2b624a0
6b983c3c5239cb6e65a69bc5391d5152e5590012170847ec091d679c70968e44
6c0dc52517171f5b3f722b563cdd6d3635b0422a4e67f35719869879d0061c32
70322b0579ed048b8bf9115205b2a6d4d07a46e151b42ac05ff3b6c39aa56077
70f0d86ab28486e9e39dab60185fccccff184e1da526a1f655d2c02b04cada3e
7114abbd10651728debfda1059bddc13e17c73ca3a0c3607ca5adb048b47fac7
743d8dd17fe3e0b81fb2f8712ea50a68e6ada040eef817ea96bff94c424b48b3
7b222cca01cef205d7ea1a27602f4d3fb3b5a32f3c2c750775d88baf3c66bc96
7b2297bb6b49f6b819aae5fd6c5d2c8f18073b1a4addb9c78101e876852c13dc
7be52968cd33e197fef54ea18403a04c9e04d4f607e00a4c5eebea4174c5249d
7c22b007743a09ec0ad5931edb3cc96fa88009586b10e0d3c502eeca52fbb183
7c7a944ba8e25f5217ce25880603765d9731155bad4ebf7968b54fa12df136d3
81cacd6b187878c8eb795e61e66c648ee76c410dafc63852de35290c1e56f9f1
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87247cfc79b1e5048a865482af8ec3828575b85cfe82c890e995d3ba8af740b0
879f1e66c89ff2411741c6a3c62704f137b8a0595b54d4953ac5caeef5a28fed
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
8b6805e13496ee237f59460d6d72f7af8d512cb9786278ce9605514566ddc8a1
8be01f8e757eb9e92da087e67908b20e70dafab8fd6969c4e4bd80886d3c3eb1
913c334189d1f0b9fe7bf564d158f4985a17ceb8d6e2cab4e5e659bc7e265735
9223e6eb171099c0a8d26458e61a9219ebacc0107853337cac5a69dd821d819b
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9bc808435e97a474ebd234009317f9f5abda4b5c4a853ab153144f1ca455500a
9ecda8c20a62889dc7334324e2d65cb4b9b680c6a13517dff2d869c2cc4fb83c
9f596e9f70b25aff0b02bd727d1be779873d9c7696aa58d86f5a6a546c146b54
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2b3c5cd0c329c390fe6c10f7f4d3e83f67fc81657ebe7daebb89ee6821cc738
a3fcfcba8bd7df8f0e016aae0562086a2268c47e22b7af5d9e7b2eedadfd5559
a4363b79dbb4640d36745601deffc98c914f7e56fb2a83a66c652c987dd6cd03
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4b1ca37d3f3d0c41e03d44698b679ce16105a8102abf7d5c6a9d15f5252e390
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
aa9e532a2dfbe0c0e1560869c9579d1912542e51ebb369497a2d09e1bf8bc30b
aad2cff9c8321968a5e16a384d96ca01da5eca8a7ae3cec7944362cd032aa13d
ab2baffa27c0b31fd237668048ec629f2edbd2ad5893c238afad699ccce75155
ab3eaca8dd9c19432ada4e805811176d0a474621b3506ab4b2acd91709e6c1bb
ad246d47536dacf0256646042ec184678bfc630fcb638d9199bd66cf8cb5e457
af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b18aa2ac0b6cf29f1a9934679c843b31eb1b5b08471e9a8ebbb02f607be2ff86
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
b9851486796787854388d4b2d20436ffa320cda2d001f6caa0cd57489f532789
b993dfd5baa98286865b515ab8d2b3b68527d9b7422c14d53d815ce97435b4bc
bae975b0fc84f1e4f02b54c98b552488635df2bc0cb7f50bf4ad5ae40a851dc6
bc29d7634ee1e158ef977eddad7126bf3e396d8b4c0fa382b395bd942231a51b
bc71a31e151ac976050a16caa9b4115f0285a004363dba9b9684c0b10a631b0e
bd9d0b5001d9b64ca2883d3732d50fe11cdb00bd4a94603f23c331d9ca2de245
be34ec9a0775d1541c4e659182d9ccf42e3a4671de5ec3235aa4ed11e7e0117c
c18d5b5f4a26d4533b225e7679bc22b96a4eeb9f3ef5b78f1ead5667cd20159e
c43aae53c7c481a2d3d74653d8869a572377c16dc821cfff277f242609e6c9d5
c4aa87f824ccf480ccac8570059622c97ee0c1d68fbd59c6513cb99ac3116ea0
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0
c80e89f43b9c32aa9597e36fd1f22d3cdff6415731d250f091ac3a390f9defd0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
d175ae345afe14519bca3ebe152a9f863e5116f8993a641c26f619f926436df0
d4f459ac6f8be24990c22bb72a64a017308fd2eb4f1a1ff0d1d0dc6dd9522af0
daf0685cf506d375d13c9fc6d13c2f9fc4b391b76b32514e3e78e93b4b7ac360
db001a2e32ab0dc68668d00818a35b967c336b27030a25a1852ba8db71ed52fd
dce37dc5a236ef35002a058b2e0fb94bacb9417230fea771de014bfc454d7c22
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
df3290feb4d92d22c4441632648386eca79b416a629567d74caf6bb922d2e704
e006e177ff87d113bb28d661d5f39d27e718538d3c7f1a1d39fcd9e3cf53ff32
e2bbfe4e8a5fc063c6da3f10a155756faa5c44a1ec731c0588a745ed2f468bde
e33d9edb33be378790da368306294d2c7b536747487e19e2d137a737dcebc85d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64225074a618ae26463e9b3809011fda4ea774e6c3cfcd7b787eac8b1e1c413
e70462e35d7e0c5ae0b1a28034d698f29a6ab869e21600c7aa1ffa2942863e43
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
ea88d35466ce56efd4aefddb9d35e65ff3f98ba89e5c2e840184a8fbff15fa06
eda144dea7a719010fe6c2e87514f5eca490b3c74f120f6ac8cb514596d4ef48
edc16e4f8de2223172e1d6034ceb1254b0749b56e0143c94915bd249c3092045
ee431f76f1af9c4f0ee67efe6267eb86e2cc7b33723c32f5168096c2c1f8e254
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f6d43bae73b7ebfcfdf6608cb5c4cdbece0f7aa052705d4088817c6621e03e03
fb9ef39c2d44d48d8cc981141a527e645a6e5b5341093872ada6cd86f18bb0fc
ff448cd042c9b87c9ff4f2c1168f5f1d56d11aecf0de7621695923cd2da3f187

www.save70.com Open in urlscan Pro 107.154.142.143 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

177 Requests

91 %HTTPS

45 %IPv6

37 Domains

54 Subdomains

44 IPs

7 Countries

2908 kBTransfer

5091 kBSize

49 Cookies

2 Outgoing links

Page URL History

Redirected requests

177 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.save70.com Open in urlscan Pro
107.154.142.143 Public Scan

Screenshot
Live screenshot

Full Image

177
Requests

91 %
HTTPS

45 %
IPv6

37
Domains

54
Subdomains

44
IPs

7
Countries

2908 kB
Transfer

5091 kB
Size

49
Cookies

177 HTTP transactions
2 data transactions