welovesa.com Open in urlscan Pro
108.181.37.5 Public Scan

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
an-x-request-uuid: 7f40e648-4e3a-47f3-aa97-c6487dcbe267
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.139; 178.162.209.139; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESELTF9pLcJTDsiputUXB4B2w&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 2FD1
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzU3MTA4OTkwNzgwOTMzNjQyMQ%3D%3D

170 B
243 B

28ms
28ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzU3MTA4OTkwNzgwOTMzNjQyMQ%3D%3D

Requested by

Protocol

Server

142.250.74.194 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
an-x-request-uuid: ab805dc1-1efb-46e7-8994-c08b42c78196
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzU3MTA4OTkwNzgwOTMzNjQyMQ%3D%3D
x-proxy-origin: 178.162.209.139; 178.162.209.139; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame F2D7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1

43 B
341 B

26ms
23ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiq5LvGATAB&v=APEucNU9B7plelljymQ9MpiDY8T9rQgiKLkJKdIaevTJhPFSnx-6I6kJUPjo7LUZSaSjmfIptgPjW99P9y5iyjbWJScegsfE2_x7jQF_zU3azg81t_0QmeqgZEtuUjeo1QWWllihquc3sI-HrpxpGQs_Jg1th9GX_5s4hBu6CEDroOMmPI8Kvkc
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oKJCEcqewr1vq5gEdGbxUydN7FJHXf66%2BBlP9kks%2BYAQD5uQnO9EB0SdyyHVdONarhYUO5Rn2i2wPAlcUgrM%2FydR84cGFOhoWfaEDzJe8%2BH0o4gXDNgbsXujyPNtpzsmvwJFE55e%2Ftj9%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81f593e84b656958-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame F2D7
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUJ-Z-vCJ3efcCsugDqD8wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1

43 B
380 B

31ms
30ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiq5LvGATAB&v=APEucNU9B7plelljymQ9MpiDY8T9rQgiKLkJKdIaevTJhPFSnx-6I6kJUPjo7LUZSaSjmfIptgPjW99P9y5iyjbWJScegsfE2_x7jQF_zU3azg81t_0QmeqgZEtuUjeo1QWWllihquc3sI-HrpxpGQs_Jg1th9GX_5s4hBu6CEDroOMmPI8Kvkc
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FoK6j90DJ%2BAuYSmf1D5ZANq%2B%2B5u2OXtayvnRrzzRpgVJ52lwVXlx%2FdR0tOkvTvybhup8Wm1K%2Buj8683yu%2Faoas14KCKIbRe2LN0A5RIkuoFh8GiLVm0rmJ3VCjpCsET4lCtz7Z6YEyU90A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81f593e87b9f6958-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame F2D7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHPecszO1Xh4HrFOMAF-5Zc&google_cver=1

43 B
841 B

19ms
16ms

Image
image/gif

185.89.210.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHPecszO1Xh4HrFOMAF-5Zc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiq5LvGATAB&v=APEucNU9B7plelljymQ9MpiDY8T9rQgiKLkJKdIaevTJhPFSnx-6I6kJUPjo7LUZSaSjmfIptgPjW99P9y5iyjbWJScegsfE2_x7jQF_zU3azg81t_0QmeqgZEtuUjeo1QWWllihquc3sI-HrpxpGQs_Jg1th9GX_5s4hBu6CEDroOMmPI8Kvkc

Protocol

Server

185.89.210.244 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
an-x-request-uuid: efbfee1c-5b3c-40e8-935a-78c9fef43856
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.139; 178.162.209.139; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHPecszO1Xh4HrFOMAF-5Zc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F2D7
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNDA0OTk3MjI4NzY4MDIyNw%3D%3D

170 B
232 B

27ms
26ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNDA0OTk3MjI4NzY4MDIyNw%3D%3D

Requested by

Protocol

Server

142.250.74.194 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-135-134-29.eu-west-2.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
an-x-request-uuid: 2721e730-609f-4d51-9eb2-a4c905de9796
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNDA0OTk3MjI4NzY4MDIyNw%3D%3D
x-proxy-origin: 178.162.209.139; 178.162.209.139; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A897 0
20 B 49ms
49ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1729264751273&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A897 0
20 B 49ms
48ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1729264751273&version=m202309260101&ct=77&x=1&cor=7073400321747031000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A897 16 KB
12 KB 69ms
68ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dnl6c9G7tnJTZ7ABj_im93hhnrSzHTN8knz7XaniZ-qCTZpTM4OmLI4N_yNBQ9wXBBg2uZ6V1pfJwfkFkUqjP_P7n_0yHFxWwXVv-VLSbcC6lX3DjUnUekV7TIymaAKAJt8ejg2Qf5PDs1Y1_gw4CjDdECPr9TJKkcb6RltodNSC35avw&cry=1&dbm_d=AKAmf-CoJRYfAXHj6kBgW7WW5BBstBF12Y9WuPEegP9OSB76Hkq3dzCShYrt4rbaNFSAWSqQzwgRcg4ug4upVXW4YmlcAwfyq7TA9IT9c7G-y128wyGugsNUUF6pVASR6KHAh-hWXCeyqew8hU8lfRX7iHrse4wvKAr9gQMKs2s1FaUF-2E6rX985dcWgvTJ1fr1UQeI5XmNGqo6jNHBFh1b531Ot7uYIiGg5DXVs0jbMTcN4vZ-saqovXZup5a3ijVnG-F6v3Ql3ENM2vImpDms6aFdHAtAqRub7fvF1AlMbCx4YGcTJgo0mb8gsDQKZxT2P6W1_rAtN6hWYd5GlbZtUp5URomVtoeffQSEskZc234W97phkOy6tD0lL-zttYECbkwTd_iKYaxUol9GVpcY8odzOFQqHHoTVQuATBRru_rXt4-la4we7zkb9_BWly5LM7YStgvnLMXHKT5qAovUeMO651CBzzzY4C6AeC-fw1LyTxAijWR8_LHDj8ZonOfqzvG2OtsC54WFIwcK5VlRQkoPDvPZ5B_1gxdLADOpYUJ9B0-VHf-03W4WdrGK1WYayQGPmmAHk_puTiTxyeIqBmZUvLpAOn6TAseq6ZeJ0teopfztKM4dmYv1uIdJUBVT6nVpm_fmGIRCTCGSRrM5A125ayeVx6hGJoauOz_vIYtpeOmWmthGbts-AMnrv_D9kyfbSeKpPgRBv4FUn_E0-48pJ9_Ot_plzrsTMTHOPyMvwQCqcyZ3qj8_kFgqHShRsuWv9kpYUTjmjo_LzwlXTxzChQj4bdTvt7BsK0TCjY_-hDmXPRCmzA7Zi4a0qJefYHv9RpVFlpRuA4yEdtX8Pt-Q0SRhJ0bH4pn9N2UyQI5HUZurGK-A9vPa1MLyw-D7eCLt2LBg6LAC9tL5Foi3Ctc8ADb2N0tcPSkL0gfgAx9P9hE3010MHTWzYOY0gHFSBRMHxAL0h5lUqU7vsrylJ3HUaRHyPlDVOWn8fRiJrXAvYBDS7vizEYf7NegHUjGAettyWf_ZjTBFSAvPx2ohr4wdjII-4QtRCxpUpVqH4nTB1QR_gcBiylEAOFCGhk3Bzl9rqDRjFsh303mZYAyI162LXS3m7iZus4EptPsssnIdWT05FYtyoLII4_6YCmQL88UlP8g0h1AwS3U9lC6bkelmMsqPeLeMLYWZm7GCzdVM8fE1iTF5-yo3UPkbzFN7X10_ehM98pIBGKoTKnMJcSb1yxxRUQyta1ZJrVze7aaPHYUqVjkj3gXHT5brXZ4g-gPXAupfqC4fG0I0jNK9MIAgETwfKPyIDOkWPgLh512ChqA-u0VWEXr587n5iMSQ1n1GBxy-jCMuD6g25pkJaXVED2c-OXMG6I96VHpmrwHILpTV2tDwQimtx3yo_bmbz7IMM4TTwtK2SlBZeR66P2T_tIwTwarAX5X2rILGuYX4c0apY9NUddTeW_D7EoB3JyatwTDWkvfrtdyF1U0lN_VU58-PAv73yH4_Sn5_Oq43KjeArJWPBRwmPOvnpPuHobkFjq4I52sQ0FuuW-LTmrOVFLyJQB1g3d4oI__BhKeURnXDPt7mRp2KJE3zwva3UXITZyDX_fx53VjMa0aLBDLwqxazKkfufmQ65ikMdGgSHUns61UlDuvL22HS_DIY5uJ9Z1-Tv_oAxZa71JyBqAW-0sgZhOyFyDhkpEB-U5HEx2mdHjClOfierPIDcsliX2KOrfYy6WfCNMv9SHxAVrAmlZpdl73K8z1GSuReEc9FGebvtmEj1ope0o5u9ObgrYgMjxmjCBdYfFEaPJGDrAxkROUvN3kDizs4qFY6fCA4_zD0ysSGXg3jBD6RoUaU6tmsgsEjZ4BRZ0EMGwXdF_QknBQPoCvDLcjODoys77jEoh_0kULYo4UOT5y-iKYmQrFq1FhgYZmzGlDr0ijOeIMpi7kk9fDETdN86qOgqlJ86_rhl8StjaY938Hpmj54auZx3XfEcP8ENgG7rZq2S2-xAxjp2qpKBRKMG-cmKB7vWPtA92ml0KlSOjmwW-sgC8o1HQoTRDvU9pKXZJhUxttsNI6CXVCmSuO2Y_9yDPGlLvoV86eRhcsiFwlARyftIPpiuvw_oDnIpWjlbQsumtTnT77g-dAjIIbjfzobhlHHqRfAEPZDzTIGSxFvIoyr8akU28gt-02FnUHK3MJxrKUf3Tv4f7Dxq1t70i7H2JTwQRbsSJWpYJS-BdLqFZr1Xa6j46E4WJ-s5oTPrc3iTjl-2-y9AutZq8sMQCJvHfdi-1PjR7b1xWPtpvZ463b4M7MfeOrl-uwC76AH76jZq6BmbGRRPfPdAWnVMirIRaxUPd1jc-2OHV5AMfh5W4XobVF9a7A2J4bDAxsZUbaC18bLkBTSUKFPKrqJaK3gZfOPt1TkDI09NuWzltOwweEdkRigt8gAlaLUTN4OTsFkJX6TI2Nhptf1dTKeAJ0VBydWjaLqMFJayWDOPVYx0CalNc1isscfGih2ghuNjgfJYB84X5rrXqOaFizXeFQzKQTNUCk7P664iC735jy8YuTVvazVDEmYMiM12l09KZ9o-GaNf6pIxb8DD9Kq2oWxyxEYRNFVndqFFTsUTqT2B7se9mtpWeun9GX_ubM20EiFAyOOX2m8j21G1_hctrppptXKVKFthvtc_oXjoSF54prGGUgMYXVi_ByCHsVfpVQ6A-Q5N1bujbJW9NhWUQQk24ffFGBL8ibk6HIXAegSSeJicsjPYInYaDCnleO3zMwg7xnThoddLduaKxT1ZXvFzD12D6PSpqbbuT3RD4rmyM79iUEcgIw7emLHX1P233yzus0riH3s0AZeZkiCtQjvFtoUPZ44V22fYunvzlIq_JrBoxwWguBWFjpvub-fuydYCb95gBe_DZkh5VOmzUcKqleUR9JKSmZiCUyQZb025j4NIKjDlxc4SyKo2lCTW0_sjW44O44uZAYaU-Zy9jIOQrVJuWnXlT61XCE12f21mZn8HL8negFJDDzuZQrvhizgpFJYKSQDSQY8d_9-LJ7lmUvi0O3yn6tJ5s3ZBDo90uCrWfMHbqiRl7UPXAOExmig7nOhgNG6jJ4L_1o6fAORZn2_m384HSjSki2-xHEfiP4lyQzfvo_WsAdpieqVb9T7nUxX1aaVrcSN5o6x45Q8pmkShtt2bGW7IK0Hi0L82tGE9OavgwQlSOPEsCWY0kmD7OyEyfWKxS50IMd1XjGEdpQHE86-_N5FEO4jkBCDtzmhSLqNHn0FQlSUpwXR9AFdoaCV2OuX0KpahtmItxK-cHdnfF6G5rHOhsN4yoG79T3LHy-ban5QdabZ-ZpImo6ORShU7fj1-5aKT1z56vC0jeOGLeXGobBYrim5elFnii5QofCBlZxw8g_wK_Q0zPPTtLvGa3UrQfuLEIrS5XsirhUfe0BFw979a-syU5FmsiZqm2LtdSWFeXatPGRTw62y-WPzdf6xLESoT0iLuB_c3U13qIbnWVEp420pb0dWFovAJoBxZ_edVogNF1bVSRgSyL5tYEA7PGV8t2sINXoaVkqaAeSW-V5VDOCvW6Gm3BlsMIW-L6qxFW8hOhDT9VkqUoXZFo6cuAovg7X36rrZOUQ9w2ZVHencpJI7KHNtoAWAXa1N-7QB6F7cZ3qkaNVNeLW7uqdHkoNmDp_pX4Bk3XfV_1c7eqc&cid=CAQSTADICaaNvDRA4Po7HF8x38ZUflTYjILsluf0VrWzhQB2VhpxgqTkaA5LAKw-zpI7R0YndEr0tGHRW8Jj6p4-dUh_ObSG3JV3dNcsaGsYAQ&dv3_ver=m202309260101&rfl=http%3A%2F%2Fwelovesa.com%2F&ds=l&xdt=1&iif=1&cor=7073400321747031000&adk=2307692975&idt=179&cac=0&dtd=26

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc554bbdab27e059f536ac8de4af7b3e8deee791327121b2af16b62c8aa570fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6889194874109189&output=html&h=230&slotname=5203004128&adk=2298390012&adf=2500649472&pi=t.ma~as.5203004128&w=230&lmt=1698853206&format=230x230&url=http%3A%2F%2Fwelovesa.com%2F&wgl=1&dt=1698856806721&bpp=4&bdt=1012&idt=206&shv=r20231030&mjsv=m202310260102&ptt=9&saldr=aa&abxe=1&correlator=5427695026629&frm=20&pv=2&ga_vid=1588780793.1698856807&ga_sid=1698856807&ga_hid=270415104&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=995&ady=293&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44804684%2C44805933%2C44807047%2C31078301%2C44803793&oid=2&pvsid=167788749781831&tmod=468553227&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=23&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&xpc=GIxmGdGpn7&p=http%3A//welovesa.com&dtd=237
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12503
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9751 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8607079609166&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9751 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8607079609166&version=m202309260101&ct=77&x=1&cor=9300594981998146000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9751 16 KB
12 KB 201ms
200ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2zOyoPIWoctDyPW-2lAFkNP2b6VfCXP0z9FEW4OV5PP5I6iWk3J0cSFHnzZnjO2iGJL3tbtcKiAui-JSuOS8Iw4vfQ0EJXtgR2gzvv0HP4FMpqIw7X-DSvYVzICTUOiFTnl7E28jSxg1WaUSHUBAdygHK4Ik4A0N18t0F4YoBN5y-uOo&cry=1&dbm_d=AKAmf-Aml8-3s8w3t9R7X1MP2WkhzsjC6K3qoYVZ3YuZqKx6j1O4g7Yjoapnzl_P_3RY-kRCc5Ve6isA-7s7wDVV9dfn8oRetLb6ddvXxI71qe6gnEYJ2921Y1YEZ5SxoXyHW1_X8P6F-FEGhnv1Mm4eI_TbZUBtVG432L1HQGtPzf9BRUC4TWCg1ALXs1B8bNKOcjFOJZ3M7ncMN9KybNE4qiiOLNcgCQwaqocXCgup_7ykRXE2Kg03kzXvPOwiHY6SmMZfJHKH6_Lpyz6QbMP4o4lFOZEFgkF4jcFc2YhvJlfLBxrin1da59GnUWMhCZxAOzS_HwjLqRuY_Tq7V_gugQptJnG_fyNTI83bnGDAfEcWozG7uFdhV9eqDjBXxlS46nxehlTPkSMJqPacHZ3xeOEwzDqUYcnFT1HTsqaqcdEVpwVW2K7q8Bp_QTlXoE9s6JkjXTeqmv2UBBEzuDaAybNf7Gkfz_DG_WeT4L1r583YW80hcjnv3MOJENzmDjZ27dxtOmVxbq9w-JLiIp_T6T20VzEHzvZWjQ3sK9Bg0-OnBKQ2n5gGlA_qLGtEtfoIFZaw0WQ5rNXCfMMbBTNQ6fYYOYnS3wDA4WuVV6cvxE7TNODIIdiOiw9vqMwZ0EGEK-XpqdcTK_iRslwBvfcWSOXs48q9s1bkKyPDN4xXuvoACEKDbwbvrGxB5xmSdwoUnN5aEMXnM-wL3KMuQeVk_IJKyghwmTPGuvoVbIxZTYgqhNgCEUOzMBc5UT6Q-ojE-XbUmIYPWcr-ovxkZ9TfpMTqH1CNsrDqc1P8M1QffFsqphnG7rSeWF1GfIFYtNr3lGmzYWcMbfEYn1yE9Gz2Zcjsme2GLtCiSyVC0XFW7GszlaXfHeNlwaBG5voio3RXGc9bXs1Xi3-7MVXsfcfj87U79rzTbKmdTg13nepowNY6ZB9QUSCP2o0M_27t5K6sMhDiOGO92NZcNP_uRdx3zmPKCqf7oLm_1jdTX9vudlBdrMUCFtDhmNKl9AF3NQMUs8tFdnz9_zQe2a3hGXtyzLUNcG9FxT6Rb6tecXlRKvpAp3gvrXSgWXM0ti8E0Uwzj1j-ysVw2VC268AI1JqM-BjDvCbUwexubwOMsBjCO9KeuSrErT9z56ikwOrkXzT_8jNamIEhEhdNdDwabllNW79L6F7VHtVlppBz2pwjQZdb1WmYa3nxBBmYRVhPuG4hXHaxYAb4Y6bw6bYNNUgV6aSUiXJp4kMfX7mHVK1ibburfNediYykwqN2rfN1iEwJj_eoj00FrLyfWgcaTQ2cggpzKgj6MqASUbVgN2mV21N1g2EH7zkoaIRTxOKI25ySkzto_FF-GtCN5OmfKgerNrICUASsjeJpqwAyvJ8FD5-_-vA3EhzcqEhQt7v5me69z_wfFQ51YiIlbDHEuXFyznmuCR9pFClzvwXOkaoLu_OuDBT2jKr0yA2FurqBrJV9J-U5luxtUAFgamR41HGS33xmQiFUS1gBRe7oOdTDyJ12ga74d-O3QJjxa12mrn12iqZ8YRmpjteJ1P5vicsbEYz1chcnuVdz_UD1tqEdb_aeypXk67UAI_BPiy9iVLOVQ2kEJQHrh1kcTGBazYmvR3xdZ3OoukPM8acQeCP8gNRh46FFwLK8rbb0JBU0jffXfn1mC7J0hic2dXFgmyBBSm40eJnN7tJNDeqnW-PM7qu78G8YyNU5j0SMq6BQANu9CurfhUbxLJ6hoIgziYcmJqirRSqzVS8GyUJWh_TvpEXFFj1N8o6hpHLFaebWCwMJAj22-qUezjJYbjtD4YnpeW2shGhRM0YewJiS--RKGoJ_Xmro2hXjHN9-3KE3T1Rpifvrbglokp7SySj8ZRoK8Y2j2VQ0BXuw8q6giBSRPBe5cROlRvTRxf6ecwiXOKLTQfH6_nPIjyB-fhbjRkPtNGApCvGPGWNJdeCYLCABxBmKwqUKY0vdxjj52PFui5jbvxbmKfPkR6QHssiLJY5HBYKNQ6UgT1xCqh8fkK5eSvj0TDvZsY5DWd-BjKUMuBqGZ57yd79a-pTZdTnoyVm1LQU_Z8f1P86z0YNUVhLwJTiwvL-9yszhH4_5WgeUMD9epPi-veMSahB5IIg9Y30JC_-1zN1fZ1KpyTEy_3uqcvs9_WGsYycqNW9QERu3IWfb3OU9wly7YkCJ5QK6hD5Gf0Z7QZEDSbdTjw4GtzlSYY7ljrYV8ov_ogPgQXb6PkCinXHQGCFKvy_rT2zOn_7D5GFju3m-DH7OSQOirTbD4DE8rrn7it1eOEI7rvXul0g_9lpUBP7eM1ixEA8WEUMMiOmKOPIp6CVeeQ4w_Cknu1les_9ZLP_aLQ-LV38pCBJeAiaU5hJpTQNgv59-HSj0ZAFETbKkFoYHGP4tEiq89m6slHwaSikp7NBQQvdrQTEZmeSJlWX-RJwo1sarfwVUzdMf3qYWqIUNEwQypYEelko34wdBTRNdkhaoA4yVRtJLQEAVvi0WJqhC2T19gi73ICYXRFKelJPYYciCTtWCkbmKmARg_8tAdF76YwB3X_ilcS7383H5Jb30eRoPnGYA-n9b7b9VxFJNfJA3COU6n4AtGUcHXZzy-bBlm0nUVlikF1s1cLvhbCvv78Dw5oXP9zVQrwD-o-wurgBpXWJnHxTqdGP0VdlHCgFR43z8G97h8mBIGldBpE5OwrDZ8njrplkHOFtd82yzUPoKMpTnv_cecU7lqjSoHioL-a8JW8gBTBAl4B7sS3fVxDNFIvp1VIUa4NZSyTZa26dy6tnzjsuh-pFyGpKBZTVQRiANyx6dOKGQLNVh3WQNthIgNomxvT5UbXon64zgETDt3pbuRt8Xtrwpt_0VAmwqpRYBxGBQ1pxuXCXJ7B6rCYDPIJQ9EkbUuD5-mP6nLQ9yXUKXs3a-n5ZDz3ukA_P2u09fpJlDQ9Y_tJkjfszbS0Bh1rp10Lp_yf6eHTuYzfl7c9POGhmdZlmGsUFvjPfwfvSWyg9j1xCkab5MnWw-P-LoJL2kSUx35cwFvbhcO-SU98B1BFYR4Pbj0uhSR9fJkyn7orFa1Ehd8E9FaT8nXSFepxIMrtHFsSuNBXP5btLy8VD31E8T7oLZo1_zrV8QvyFpHVBQBbQgEzGv-Nw7_nMZ-vsU438fpmkWz8AwjpXCksHtdmd4AoBCgpTXGdDjoKS92GZgt9N3IkNmPMt6vql234Ipfi8XXSNDT9al78HG2KSLU1DqWVz_AGPfARgEYLSsB7ecDgJxW3f1LfMEn4ApWkSk-PPQ53nXytl-KG8Te8VMBC2hDWHfmD6jirHGcqS572jFExvqoDi0ZLYMl120q1ZsgXUZrYwyTSffwLGAXaJRw4c7fdjOpkRocV3X1jC--B6jh2wpSrzoVKYbazBt6sDx9WCiT90bo3Ufvk1uW7Ibgjg_TpMvmY4dJ8AQE2EX3NrMQlkHbNpcMFo9xueUE8ITYlEaWt8yUTzLRQ15p8OkvrN30zAFeVLhJOkcdewejWfoXKdfPDQYEVjLfo32dD69VT5MYUeFD3k1mlYOF7zqm_0YIe5OstN-_S3bTIt2-XkYcxWjOhrP_onwoM6j2pFc669UokT4yGyrlDgx4paq8Jw9aoFFe8IQ-LyCy3ehVL4tq7FlT6KD5oLuoCzNAATvS7r8VCN0tudteR-VdoM3QV_npxrnelP-uAr909gfKLM7KeuugjCK&cid=CAQSSwDICaaNOgYlrYT-1p5fnyWi-Y2bpPNFOeLFqjObFrsmIF02N7CxcsNKH0_BVjhCHujJVtYbfBoicdDifH4StJDYp2C0lytfiPF_DBgB&dv3_ver=m202309260101&rfl=http%3A%2F%2Fwelovesa.com%2F&ds=l&xdt=1&iif=1&cor=9300594981998146000&adk=2124396030&idt=212&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90488d209bbdf120a7b64192befeebbc526a3cf099b31113bf9b188201732301

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6889194874109189&output=html&h=230&slotname=5203004128&adk=2298390012&adf=2458201212&pi=t.ma~as.5203004128&w=230&lmt=1698853206&format=230x230&url=http%3A%2F%2Fwelovesa.com%2F&wgl=1&dt=1698856806725&bpp=1&bdt=1017&idt=239&shv=r20231030&mjsv=m202310260102&ptt=9&saldr=aa&abxe=1&prev_fmts=230x230&correlator=5427695026629&frm=20&pv=1&ga_vid=1588780793.1698856807&ga_sid=1698856807&ga_hid=270415104&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=995&ady=523&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44804684%2C44805933%2C44807047%2C31078301%2C44803793&oid=2&pvsid=167788749781831&tmod=468553227&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=23&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=nblX1mT6P7&p=http%3A//welovesa.com&dtd=249
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12309
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame A897 41 KB
14 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dnl6c9G7tnJTZ7ABj_im93hhnrSzHTN8knz7XaniZ-qCTZpTM4OmLI4N_yNBQ9wXBBg2uZ6V1pfJwfkFkUqjP_P7n_0yHFxWwXVv-VLSbcC6lX3DjUnUekV7TIymaAKAJt8ejg2Qf5PDs1Y1_gw4CjDdECPr9TJKkcb6RltodNSC35avw&cry=1&dbm_d=AKAmf-CoJRYfAXHj6kBgW7WW5BBstBF12Y9WuPEegP9OSB76Hkq3dzCShYrt4rbaNFSAWSqQzwgRcg4ug4upVXW4YmlcAwfyq7TA9IT9c7G-y128wyGugsNUUF6pVASR6KHAh-hWXCeyqew8hU8lfRX7iHrse4wvKAr9gQMKs2s1FaUF-2E6rX985dcWgvTJ1fr1UQeI5XmNGqo6jNHBFh1b531Ot7uYIiGg5DXVs0jbMTcN4vZ-saqovXZup5a3ijVnG-F6v3Ql3ENM2vImpDms6aFdHAtAqRub7fvF1AlMbCx4YGcTJgo0mb8gsDQKZxT2P6W1_rAtN6hWYd5GlbZtUp5URomVtoeffQSEskZc234W97phkOy6tD0lL-zttYECbkwTd_iKYaxUol9GVpcY8odzOFQqHHoTVQuATBRru_rXt4-la4we7zkb9_BWly5LM7YStgvnLMXHKT5qAovUeMO651CBzzzY4C6AeC-fw1LyTxAijWR8_LHDj8ZonOfqzvG2OtsC54WFIwcK5VlRQkoPDvPZ5B_1gxdLADOpYUJ9B0-VHf-03W4WdrGK1WYayQGPmmAHk_puTiTxyeIqBmZUvLpAOn6TAseq6ZeJ0teopfztKM4dmYv1uIdJUBVT6nVpm_fmGIRCTCGSRrM5A125ayeVx6hGJoauOz_vIYtpeOmWmthGbts-AMnrv_D9kyfbSeKpPgRBv4FUn_E0-48pJ9_Ot_plzrsTMTHOPyMvwQCqcyZ3qj8_kFgqHShRsuWv9kpYUTjmjo_LzwlXTxzChQj4bdTvt7BsK0TCjY_-hDmXPRCmzA7Zi4a0qJefYHv9RpVFlpRuA4yEdtX8Pt-Q0SRhJ0bH4pn9N2UyQI5HUZurGK-A9vPa1MLyw-D7eCLt2LBg6LAC9tL5Foi3Ctc8ADb2N0tcPSkL0gfgAx9P9hE3010MHTWzYOY0gHFSBRMHxAL0h5lUqU7vsrylJ3HUaRHyPlDVOWn8fRiJrXAvYBDS7vizEYf7NegHUjGAettyWf_ZjTBFSAvPx2ohr4wdjII-4QtRCxpUpVqH4nTB1QR_gcBiylEAOFCGhk3Bzl9rqDRjFsh303mZYAyI162LXS3m7iZus4EptPsssnIdWT05FYtyoLII4_6YCmQL88UlP8g0h1AwS3U9lC6bkelmMsqPeLeMLYWZm7GCzdVM8fE1iTF5-yo3UPkbzFN7X10_ehM98pIBGKoTKnMJcSb1yxxRUQyta1ZJrVze7aaPHYUqVjkj3gXHT5brXZ4g-gPXAupfqC4fG0I0jNK9MIAgETwfKPyIDOkWPgLh512ChqA-u0VWEXr587n5iMSQ1n1GBxy-jCMuD6g25pkJaXVED2c-OXMG6I96VHpmrwHILpTV2tDwQimtx3yo_bmbz7IMM4TTwtK2SlBZeR66P2T_tIwTwarAX5X2rILGuYX4c0apY9NUddTeW_D7EoB3JyatwTDWkvfrtdyF1U0lN_VU58-PAv73yH4_Sn5_Oq43KjeArJWPBRwmPOvnpPuHobkFjq4I52sQ0FuuW-LTmrOVFLyJQB1g3d4oI__BhKeURnXDPt7mRp2KJE3zwva3UXITZyDX_fx53VjMa0aLBDLwqxazKkfufmQ65ikMdGgSHUns61UlDuvL22HS_DIY5uJ9Z1-Tv_oAxZa71JyBqAW-0sgZhOyFyDhkpEB-U5HEx2mdHjClOfierPIDcsliX2KOrfYy6WfCNMv9SHxAVrAmlZpdl73K8z1GSuReEc9FGebvtmEj1ope0o5u9ObgrYgMjxmjCBdYfFEaPJGDrAxkROUvN3kDizs4qFY6fCA4_zD0ysSGXg3jBD6RoUaU6tmsgsEjZ4BRZ0EMGwXdF_QknBQPoCvDLcjODoys77jEoh_0kULYo4UOT5y-iKYmQrFq1FhgYZmzGlDr0ijOeIMpi7kk9fDETdN86qOgqlJ86_rhl8StjaY938Hpmj54auZx3XfEcP8ENgG7rZq2S2-xAxjp2qpKBRKMG-cmKB7vWPtA92ml0KlSOjmwW-sgC8o1HQoTRDvU9pKXZJhUxttsNI6CXVCmSuO2Y_9yDPGlLvoV86eRhcsiFwlARyftIPpiuvw_oDnIpWjlbQsumtTnT77g-dAjIIbjfzobhlHHqRfAEPZDzTIGSxFvIoyr8akU28gt-02FnUHK3MJxrKUf3Tv4f7Dxq1t70i7H2JTwQRbsSJWpYJS-BdLqFZr1Xa6j46E4WJ-s5oTPrc3iTjl-2-y9AutZq8sMQCJvHfdi-1PjR7b1xWPtpvZ463b4M7MfeOrl-uwC76AH76jZq6BmbGRRPfPdAWnVMirIRaxUPd1jc-2OHV5AMfh5W4XobVF9a7A2J4bDAxsZUbaC18bLkBTSUKFPKrqJaK3gZfOPt1TkDI09NuWzltOwweEdkRigt8gAlaLUTN4OTsFkJX6TI2Nhptf1dTKeAJ0VBydWjaLqMFJayWDOPVYx0CalNc1isscfGih2ghuNjgfJYB84X5rrXqOaFizXeFQzKQTNUCk7P664iC735jy8YuTVvazVDEmYMiM12l09KZ9o-GaNf6pIxb8DD9Kq2oWxyxEYRNFVndqFFTsUTqT2B7se9mtpWeun9GX_ubM20EiFAyOOX2m8j21G1_hctrppptXKVKFthvtc_oXjoSF54prGGUgMYXVi_ByCHsVfpVQ6A-Q5N1bujbJW9NhWUQQk24ffFGBL8ibk6HIXAegSSeJicsjPYInYaDCnleO3zMwg7xnThoddLduaKxT1ZXvFzD12D6PSpqbbuT3RD4rmyM79iUEcgIw7emLHX1P233yzus0riH3s0AZeZkiCtQjvFtoUPZ44V22fYunvzlIq_JrBoxwWguBWFjpvub-fuydYCb95gBe_DZkh5VOmzUcKqleUR9JKSmZiCUyQZb025j4NIKjDlxc4SyKo2lCTW0_sjW44O44uZAYaU-Zy9jIOQrVJuWnXlT61XCE12f21mZn8HL8negFJDDzuZQrvhizgpFJYKSQDSQY8d_9-LJ7lmUvi0O3yn6tJ5s3ZBDo90uCrWfMHbqiRl7UPXAOExmig7nOhgNG6jJ4L_1o6fAORZn2_m384HSjSki2-xHEfiP4lyQzfvo_WsAdpieqVb9T7nUxX1aaVrcSN5o6x45Q8pmkShtt2bGW7IK0Hi0L82tGE9OavgwQlSOPEsCWY0kmD7OyEyfWKxS50IMd1XjGEdpQHE86-_N5FEO4jkBCDtzmhSLqNHn0FQlSUpwXR9AFdoaCV2OuX0KpahtmItxK-cHdnfF6G5rHOhsN4yoG79T3LHy-ban5QdabZ-ZpImo6ORShU7fj1-5aKT1z56vC0jeOGLeXGobBYrim5elFnii5QofCBlZxw8g_wK_Q0zPPTtLvGa3UrQfuLEIrS5XsirhUfe0BFw979a-syU5FmsiZqm2LtdSWFeXatPGRTw62y-WPzdf6xLESoT0iLuB_c3U13qIbnWVEp420pb0dWFovAJoBxZ_edVogNF1bVSRgSyL5tYEA7PGV8t2sINXoaVkqaAeSW-V5VDOCvW6Gm3BlsMIW-L6qxFW8hOhDT9VkqUoXZFo6cuAovg7X36rrZOUQ9w2ZVHencpJI7KHNtoAWAXa1N-7QB6F7cZ3qkaNVNeLW7uqdHkoNmDp_pX4Bk3XfV_1c7eqc&cid=CAQSTADICaaNvDRA4Po7HF8x38ZUflTYjILsluf0VrWzhQB2VhpxgqTkaA5LAKw-zpI7R0YndEr0tGHRW8Jj6p4-dUh_ObSG3JV3dNcsaGsYAQ&dv3_ver=m202309260101&rfl=http%3A%2F%2Fwelovesa.com%2F&ds=l&xdt=1&iif=1&cor=7073400321747031000&adk=2307692975&idt=179&cac=0&dtd=26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 14:17:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 14:17:59 GMT

GET
H/1.1 200
OK g2gqt23fm9fm Show response
hal9000.redintelligence.net/zone/ Frame A897 11 KB
4 KB 61ms
13ms Script
text/html 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g2gqt23fm9fm?subid=&gdpr=&gdpr_consent=&rnd=1698856807069846&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7-jJZ39CZdahBJbziQPiyprQCqblvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCUyplZI6ysT6oAwHIA5sEqgTkAU_QkQpzXfqU6yeSJHjixq5y6YqNAUUrmXY_RGLqRAM8CAPieMshyb_bbI8oz1z9cZvZgzjFngweDDs39BlNJxh0vYnAXcMrz_DdK6JS0qeIbH6y4HDQo5jidF3H4acUJT58buQjPSpJUwSiuOO20BsOCEI4vYuo_OtFqfuKMUzkKjT3To0R6K2sYYTrOa5qsm4pGVnStt0bt3bUQzlKjQhBqdDQ3jUHhSyma_HkchM2QRKjpbtX-av-7qkCXKMpdsmSwIuwPDYD4oZUV5sQ34cw5hSz4dSZnql6I6nPSNXl5FBSXMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADICaaNvDRA4Po7HF8x38ZUflTYjILsluf0VrWzhQB2VhpxgqTkaA5LAKw-zpI7R0YndEr0tGHRW8Jj6p4-dUh_ObSG3JV3dNcsaGsYAQ%26sig%3DAOD64_11O61oI76HMkI-OjiTX0CeltSang%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-CTgQY9QxvInYJUvzZwx9YzP78Pohz2AHRcsbeG45rkMbvbFh9iJFT4wKd3EsinN4v2-UZYWy1TjTUyNQBFqMdimBz0IXbsdDnBwu0ZzGRoi47dZfxg7UICugTvCcjWJjRgQH2yodlyqrhU9-XW-JGRCWB77KBBI-0eGJk_CFNalKp6KAk%26cry%3D1%26dbm_d%3DAKAmf-Cb6FPOqXUDEpRGso9uzVI_CYmY6kM72uNm7V-2nQ8d4ZmGBQz7FxDueodbjHkgp2yy6YRoFhhDHzS14_OtmT05yE__ggFY2fKuf1bKmmP2FVLKhg_-gNAOEUcR9ec1DSAotYE3YgMtIL5aPlenTkAsenNIeZK9pTfv20Yl0FmmxcNYo3MRn_DWWkHd3Oxw7GcYlgIt4X2Fk8Z2P0zObdGNFsxVBT5qKzEP5JJhg6vw3R1atZQruZHT8lE8KbFGE2qV6AJgBHqbg4WrA7AM0jj-uDf4wnS6xk97yzS0hCp_zDzXYGGP6CgbPpMye2y79EpVjx8lPx2_zBEQ-hb7dCe4DdASXw-xYPGHGPWokrEZiZZJN0xE5oPhznwx2hsYHsIFSjBqANaQeY9yXhKkELM9V18zrVqPBSH6iMDKP4NWQWqym9Y1cEqHHaFh5FwLGo098bkSQv3ZKB0QSmiNWmubtiv6Vmxng1A2geVq9rtfn_HVm1Wl7CMoaZRlE2r81OvA5d2gGrROl6dBvYp-7hKJkZQ9XMwIxWH1Cpq_p0K5LKme2M4%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6889194874109189&output=html&h=230&slotname=5203004128&adk=2298390012&adf=2500649472&pi=t.ma~as.5203004128&w=230&lmt=1698853206&format=230x230&url=http%3A%2F%2Fwelovesa.com%2F&wgl=1&dt=1698856806721&bpp=4&bdt=1012&idt=206&shv=r20231030&mjsv=m202310260102&ptt=9&saldr=aa&abxe=1&correlator=5427695026629&frm=20&pv=2&ga_vid=1588780793.1698856807&ga_sid=1698856807&ga_hid=270415104&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=995&ady=293&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44804684%2C44805933%2C44807047%2C31078301%2C44803793&oid=2&pvsid=167788749781831&tmod=468553227&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=23&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&xpc=GIxmGdGpn7&p=http%3A//welovesa.com&dtd=237
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 9138504e97305e367acf91f3f5498e98edb3eef0c7be0a018b00de39084250d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Wed, 01 Nov 2023 16:40:07 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4150
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 718E 38 KB
13 KB 16ms
15ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 440506
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 14:18:21 GMT
expires: Sat, 26 Oct 2024 14:18:21 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal90007.redintelligence.net/ Frame A897
Redirect Chain

https://hal90007.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=596a14bd37&subid=&uid=7eda4ad276ad2a7c&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90007.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=596a14bd37&subid=&uid=7eda4ad276ad2a7c&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

3 KB
2 KB

119ms
96ms

Script
application/x-javascript

138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=596a14bd37&subid=&uid=7eda4ad276ad2a7c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7-jJZ39CZdahBJbziQPiyprQCqblvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCUyplZI6ysT6oAwHIA5sEqgTkAU_QkQpzXfqU6yeSJHjixq5y6YqNAUUrmXY_RGLqRAM8CAPieMshyb_bbI8oz1z9cZvZgzjFngweDDs39BlNJxh0vYnAXcMrz_DdK6JS0qeIbH6y4HDQo5jidF3H4acUJT58buQjPSpJUwSiuOO20BsOCEI4vYuo_OtFqfuKMUzkKjT3To0R6K2sYYTrOa5qsm4pGVnStt0bt3bUQzlKjQhBqdDQ3jUHhSyma_HkchM2QRKjpbtX-av-7qkCXKMpdsmSwIuwPDYD4oZUV5sQ34cw5hSz4dSZnql6I6nPSNXl5FBSXMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADICaaNvDRA4Po7HF8x38ZUflTYjILsluf0VrWzhQB2VhpxgqTkaA5LAKw-zpI7R0YndEr0tGHRW8Jj6p4-dUh_ObSG3JV3dNcsaGsYAQ%26sig%3DAOD64_11O61oI76HMkI-OjiTX0CeltSang%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-CTgQY9QxvInYJUvzZwx9YzP78Pohz2AHRcsbeG45rkMbvbFh9iJFT4wKd3EsinN4v2-UZYWy1TjTUyNQBFqMdimBz0IXbsdDnBwu0ZzGRoi47dZfxg7UICugTvCcjWJjRgQH2yodlyqrhU9-XW-JGRCWB77KBBI-0eGJk_CFNalKp6KAk%26cry%3D1%26dbm_d%3DAKAmf-Cb6FPOqXUDEpRGso9uzVI_CYmY6kM72uNm7V-2nQ8d4ZmGBQz7FxDueodbjHkgp2yy6YRoFhhDHzS14_OtmT05yE__ggFY2fKuf1bKmmP2FVLKhg_-gNAOEUcR9ec1DSAotYE3YgMtIL5aPlenTkAsenNIeZK9pTfv20Yl0FmmxcNYo3MRn_DWWkHd3Oxw7GcYlgIt4X2Fk8Z2P0zObdGNFsxVBT5qKzEP5JJhg6vw3R1atZQruZHT8lE8KbFGE2qV6AJgBHqbg4WrA7AM0jj-uDf4wnS6xk97yzS0hCp_zDzXYGGP6CgbPpMye2y79EpVjx8lPx2_zBEQ-hb7dCe4DdASXw-xYPGHGPWokrEZiZZJN0xE5oPhznwx2hsYHsIFSjBqANaQeY9yXhKkELM9V18zrVqPBSH6iMDKP4NWQWqym9Y1cEqHHaFh5FwLGo098bkSQv3ZKB0QSmiNWmubtiv6Vmxng1A2geVq9rtfn_HVm1Wl7CMoaZRlE2r81OvA5d2gGrROl6dBvYp-7hKJkZQ9XMwIxWH1Cpq_p0K5LKme2M4%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6889194874109189%26output%3Dhtml%26h%3D230%26slotname%3D5203004128%26adk%3D2298390012%26adf%3D2500649472%26pi%3Dt.ma~as.5203004128%26w%3D230%26lmt%3D1698853206%26format%3D230x230%26url%3Dhttp%253A%252F%252Fwelovesa.com%252F%26wgl%3D1%26dt%3D1698856806721%26bpp%3D4%26bdt%3D1012%26idt%3D206%26shv%3Dr20231030%26mjsv%3Dm202310260102%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D5427695026629%26frm%3D20%26pv%3D2%26ga_vid%3D1588780793.1698856807%26ga_sid%3D1698856807%26ga_hid%3D270415104%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D995%26ady%3D293%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C44804684%252C44805933%252C44807047%252C31078301%252C44803793%26oid%3D2%26pvsid%3D167788749781831%26tmod%3D468553227%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CeE%257Cn%26abl%3DXS%26pfx%3D0%26fu%3D0%26bc%3D23%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DGIxmGdGpn7%26p%3Dhttp%253A%2F%2Fwelovesa.com%26dtd%3D237&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fwelovesa.com&random=8484240025875&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6889194874109189&output=html&h=230&slotname=5203004128&adk=2298390012&adf=2500649472&pi=t.ma~as.5203004128&w=230&lmt=1698853206&format=230x230&url=http%3A%2F%2Fwelovesa.com%2F&wgl=1&dt=1698856806721&bpp=4&bdt=1012&idt=206&shv=r20231030&mjsv=m202310260102&ptt=9&saldr=aa&abxe=1&correlator=5427695026629&frm=20&pv=2&ga_vid=1588780793.1698856807&ga_sid=1698856807&ga_hid=270415104&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=995&ady=293&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44804684%2C44805933%2C44807047%2C31078301%2C44803793&oid=2&pvsid=167788749781831&tmod=468553227&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=23&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&xpc=GIxmGdGpn7&p=http%3A//welovesa.com&dtd=237
Protocol: HTTP/1.1
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0bb5dc5a32268d2ce794785859999329989ab106aa198b58705b26009c6a1a66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 01 Nov 2023 16:40:08 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 62038500125864904444992012495007
Connection: close
Content-Length: 1012
Expires: Wed, 01 Nov 2023 16:40:08 +0100

Redirect headers

Pragma: no-cache
Date: Wed, 01 Nov 2023 16:40:07 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=596a14bd37&subid=&uid=7eda4ad276ad2a7c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7-jJZ39CZdahBJbziQPiyprQCqblvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCUyplZI6ysT6oAwHIA5sEqgTkAU_QkQpzXfqU6yeSJHjixq5y6YqNAUUrmXY_RGLqRAM8CAPieMshyb_bbI8oz1z9cZvZgzjFngweDDs39BlNJxh0vYnAXcMrz_DdK6JS0qeIbH6y4HDQo5jidF3H4acUJT58buQjPSpJUwSiuOO20BsOCEI4vYuo_OtFqfuKMUzkKjT3To0R6K2sYYTrOa5qsm4pGVnStt0bt3bUQzlKjQhBqdDQ3jUHhSyma_HkchM2QRKjpbtX-av-7qkCXKMpdsmSwIuwPDYD4oZUV5sQ34cw5hSz4dSZnql6I6nPSNXl5FBSXMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADICaaNvDRA4Po7HF8x38ZUflTYjILsluf0VrWzhQB2VhpxgqTkaA5LAKw-zpI7R0YndEr0tGHRW8Jj6p4-dUh_ObSG3JV3dNcsaGsYAQ%26sig%3DAOD64_11O61oI76HMkI-OjiTX0CeltSang%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-CTgQY9QxvInYJUvzZwx9YzP78Pohz2AHRcsbeG45rkMbvbFh9iJFT4wKd3EsinN4v2-UZYWy1TjTUyNQBFqMdimBz0IXbsdDnBwu0ZzGRoi47dZfxg7UICugTvCcjWJjRgQH2yodlyqrhU9-XW-JGRCWB77KBBI-0eGJk_CFNalKp6KAk%26cry%3D1%26dbm_d%3DAKAmf-Cb6FPOqXUDEpRGso9uzVI_CYmY6kM72uNm7V-2nQ8d4ZmGBQz7FxDueodbjHkgp2yy6YRoFhhDHzS14_OtmT05yE__ggFY2fKuf1bKmmP2FVLKhg_-gNAOEUcR9ec1DSAotYE3YgMtIL5aPlenTkAsenNIeZK9pTfv20Yl0FmmxcNYo3MRn_DWWkHd3Oxw7GcYlgIt4X2Fk8Z2P0zObdGNFsxVBT5qKzEP5JJhg6vw3R1atZQruZHT8lE8KbFGE2qV6AJgBHqbg4WrA7AM0jj-uDf4wnS6xk97yzS0hCp_zDzXYGGP6CgbPpMye2y79EpVjx8lPx2_zBEQ-hb7dCe4DdASXw-xYPGHGPWokrEZiZZJN0xE5oPhznwx2hsYHsIFSjBqANaQeY9yXhKkELM9V18zrVqPBSH6iMDKP4NWQWqym9Y1cEqHHaFh5FwLGo098bkSQv3ZKB0QSmiNWmubtiv6Vmxng1A2geVq9rtfn_HVm1Wl7CMoaZRlE2r81OvA5d2gGrROl6dBvYp-7hKJkZQ9XMwIxWH1Cpq_p0K5LKme2M4%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6889194874109189%26output%3Dhtml%26h%3D230%26slotname%3D5203004128%26adk%3D2298390012%26adf%3D2500649472%26pi%3Dt.ma~as.5203004128%26w%3D230%26lmt%3D1698853206%26format%3D230x230%26url%3Dhttp%253A%252F%252Fwelovesa.com%252F%26wgl%3D1%26dt%3D1698856806721%26bpp%3D4%26bdt%3D1012%26idt%3D206%26shv%3Dr20231030%26mjsv%3Dm202310260102%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D5427695026629%26frm%3D20%26pv%3D2%26ga_vid%3D1588780793.1698856807%26ga_sid%3D1698856807%26ga_hid%3D270415104%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D995%26ady%3D293%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C44804684%252C44805933%252C44807047%252C31078301%252C44803793%26oid%3D2%26pvsid%3D167788749781831%26tmod%3D468553227%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CeE%257Cn%26abl%3DXS%26pfx%3D0%26fu%3D0%26bc%3D23%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DGIxmGdGpn7%26p%3Dhttp%253A%2F%2Fwelovesa.com%26dtd%3D237&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fwelovesa.com&random=8484240025875&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Wed, 01 Nov 2023 16:40:07 +0100

GET
H3 200 mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js Show response
pagead2.googlesyndication.com/bg/ Frame 718E 38 KB
15 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99235240097ffe1c3ccf93f0275840df66a62f6ce406788402b06df413755d67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 15:45:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3291
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15010
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 31 Oct 2024 15:45:16 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9751 41 KB
14 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2zOyoPIWoctDyPW-2lAFkNP2b6VfCXP0z9FEW4OV5PP5I6iWk3J0cSFHnzZnjO2iGJL3tbtcKiAui-JSuOS8Iw4vfQ0EJXtgR2gzvv0HP4FMpqIw7X-DSvYVzICTUOiFTnl7E28jSxg1WaUSHUBAdygHK4Ik4A0N18t0F4YoBN5y-uOo&cry=1&dbm_d=AKAmf-Aml8-3s8w3t9R7X1MP2WkhzsjC6K3qoYVZ3YuZqKx6j1O4g7Yjoapnzl_P_3RY-kRCc5Ve6isA-7s7wDVV9dfn8oRetLb6ddvXxI71qe6gnEYJ2921Y1YEZ5SxoXyHW1_X8P6F-FEGhnv1Mm4eI_TbZUBtVG432L1HQGtPzf9BRUC4TWCg1ALXs1B8bNKOcjFOJZ3M7ncMN9KybNE4qiiOLNcgCQwaqocXCgup_7ykRXE2Kg03kzXvPOwiHY6SmMZfJHKH6_Lpyz6QbMP4o4lFOZEFgkF4jcFc2YhvJlfLBxrin1da59GnUWMhCZxAOzS_HwjLqRuY_Tq7V_gugQptJnG_fyNTI83bnGDAfEcWozG7uFdhV9eqDjBXxlS46nxehlTPkSMJqPacHZ3xeOEwzDqUYcnFT1HTsqaqcdEVpwVW2K7q8Bp_QTlXoE9s6JkjXTeqmv2UBBEzuDaAybNf7Gkfz_DG_WeT4L1r583YW80hcjnv3MOJENzmDjZ27dxtOmVxbq9w-JLiIp_T6T20VzEHzvZWjQ3sK9Bg0-OnBKQ2n5gGlA_qLGtEtfoIFZaw0WQ5rNXCfMMbBTNQ6fYYOYnS3wDA4WuVV6cvxE7TNODIIdiOiw9vqMwZ0EGEK-XpqdcTK_iRslwBvfcWSOXs48q9s1bkKyPDN4xXuvoACEKDbwbvrGxB5xmSdwoUnN5aEMXnM-wL3KMuQeVk_IJKyghwmTPGuvoVbIxZTYgqhNgCEUOzMBc5UT6Q-ojE-XbUmIYPWcr-ovxkZ9TfpMTqH1CNsrDqc1P8M1QffFsqphnG7rSeWF1GfIFYtNr3lGmzYWcMbfEYn1yE9Gz2Zcjsme2GLtCiSyVC0XFW7GszlaXfHeNlwaBG5voio3RXGc9bXs1Xi3-7MVXsfcfj87U79rzTbKmdTg13nepowNY6ZB9QUSCP2o0M_27t5K6sMhDiOGO92NZcNP_uRdx3zmPKCqf7oLm_1jdTX9vudlBdrMUCFtDhmNKl9AF3NQMUs8tFdnz9_zQe2a3hGXtyzLUNcG9FxT6Rb6tecXlRKvpAp3gvrXSgWXM0ti8E0Uwzj1j-ysVw2VC268AI1JqM-BjDvCbUwexubwOMsBjCO9KeuSrErT9z56ikwOrkXzT_8jNamIEhEhdNdDwabllNW79L6F7VHtVlppBz2pwjQZdb1WmYa3nxBBmYRVhPuG4hXHaxYAb4Y6bw6bYNNUgV6aSUiXJp4kMfX7mHVK1ibburfNediYykwqN2rfN1iEwJj_eoj00FrLyfWgcaTQ2cggpzKgj6MqASUbVgN2mV21N1g2EH7zkoaIRTxOKI25ySkzto_FF-GtCN5OmfKgerNrICUASsjeJpqwAyvJ8FD5-_-vA3EhzcqEhQt7v5me69z_wfFQ51YiIlbDHEuXFyznmuCR9pFClzvwXOkaoLu_OuDBT2jKr0yA2FurqBrJV9J-U5luxtUAFgamR41HGS33xmQiFUS1gBRe7oOdTDyJ12ga74d-O3QJjxa12mrn12iqZ8YRmpjteJ1P5vicsbEYz1chcnuVdz_UD1tqEdb_aeypXk67UAI_BPiy9iVLOVQ2kEJQHrh1kcTGBazYmvR3xdZ3OoukPM8acQeCP8gNRh46FFwLK8rbb0JBU0jffXfn1mC7J0hic2dXFgmyBBSm40eJnN7tJNDeqnW-PM7qu78G8YyNU5j0SMq6BQANu9CurfhUbxLJ6hoIgziYcmJqirRSqzVS8GyUJWh_TvpEXFFj1N8o6hpHLFaebWCwMJAj22-qUezjJYbjtD4YnpeW2shGhRM0YewJiS--RKGoJ_Xmro2hXjHN9-3KE3T1Rpifvrbglokp7SySj8ZRoK8Y2j2VQ0BXuw8q6giBSRPBe5cROlRvTRxf6ecwiXOKLTQfH6_nPIjyB-fhbjRkPtNGApCvGPGWNJdeCYLCABxBmKwqUKY0vdxjj52PFui5jbvxbmKfPkR6QHssiLJY5HBYKNQ6UgT1xCqh8fkK5eSvj0TDvZsY5DWd-BjKUMuBqGZ57yd79a-pTZdTnoyVm1LQU_Z8f1P86z0YNUVhLwJTiwvL-9yszhH4_5WgeUMD9epPi-veMSahB5IIg9Y30JC_-1zN1fZ1KpyTEy_3uqcvs9_WGsYycqNW9QERu3IWfb3OU9wly7YkCJ5QK6hD5Gf0Z7QZEDSbdTjw4GtzlSYY7ljrYV8ov_ogPgQXb6PkCinXHQGCFKvy_rT2zOn_7D5GFju3m-DH7OSQOirTbD4DE8rrn7it1eOEI7rvXul0g_9lpUBP7eM1ixEA8WEUMMiOmKOPIp6CVeeQ4w_Cknu1les_9ZLP_aLQ-LV38pCBJeAiaU5hJpTQNgv59-HSj0ZAFETbKkFoYHGP4tEiq89m6slHwaSikp7NBQQvdrQTEZmeSJlWX-RJwo1sarfwVUzdMf3qYWqIUNEwQypYEelko34wdBTRNdkhaoA4yVRtJLQEAVvi0WJqhC2T19gi73ICYXRFKelJPYYciCTtWCkbmKmARg_8tAdF76YwB3X_ilcS7383H5Jb30eRoPnGYA-n9b7b9VxFJNfJA3COU6n4AtGUcHXZzy-bBlm0nUVlikF1s1cLvhbCvv78Dw5oXP9zVQrwD-o-wurgBpXWJnHxTqdGP0VdlHCgFR43z8G97h8mBIGldBpE5OwrDZ8njrplkHOFtd82yzUPoKMpTnv_cecU7lqjSoHioL-a8JW8gBTBAl4B7sS3fVxDNFIvp1VIUa4NZSyTZa26dy6tnzjsuh-pFyGpKBZTVQRiANyx6dOKGQLNVh3WQNthIgNomxvT5UbXon64zgETDt3pbuRt8Xtrwpt_0VAmwqpRYBxGBQ1pxuXCXJ7B6rCYDPIJQ9EkbUuD5-mP6nLQ9yXUKXs3a-n5ZDz3ukA_P2u09fpJlDQ9Y_tJkjfszbS0Bh1rp10Lp_yf6eHTuYzfl7c9POGhmdZlmGsUFvjPfwfvSWyg9j1xCkab5MnWw-P-LoJL2kSUx35cwFvbhcO-SU98B1BFYR4Pbj0uhSR9fJkyn7orFa1Ehd8E9FaT8nXSFepxIMrtHFsSuNBXP5btLy8VD31E8T7oLZo1_zrV8QvyFpHVBQBbQgEzGv-Nw7_nMZ-vsU438fpmkWz8AwjpXCksHtdmd4AoBCgpTXGdDjoKS92GZgt9N3IkNmPMt6vql234Ipfi8XXSNDT9al78HG2KSLU1DqWVz_AGPfARgEYLSsB7ecDgJxW3f1LfMEn4ApWkSk-PPQ53nXytl-KG8Te8VMBC2hDWHfmD6jirHGcqS572jFExvqoDi0ZLYMl120q1ZsgXUZrYwyTSffwLGAXaJRw4c7fdjOpkRocV3X1jC--B6jh2wpSrzoVKYbazBt6sDx9WCiT90bo3Ufvk1uW7Ibgjg_TpMvmY4dJ8AQE2EX3NrMQlkHbNpcMFo9xueUE8ITYlEaWt8yUTzLRQ15p8OkvrN30zAFeVLhJOkcdewejWfoXKdfPDQYEVjLfo32dD69VT5MYUeFD3k1mlYOF7zqm_0YIe5OstN-_S3bTIt2-XkYcxWjOhrP_onwoM6j2pFc669UokT4yGyrlDgx4paq8Jw9aoFFe8IQ-LyCy3ehVL4tq7FlT6KD5oLuoCzNAATvS7r8VCN0tudteR-VdoM3QV_npxrnelP-uAr909gfKLM7KeuugjCK&cid=CAQSSwDICaaNOgYlrYT-1p5fnyWi-Y2bpPNFOeLFqjObFrsmIF02N7CxcsNKH0_BVjhCHujJVtYbfBoicdDifH4StJDYp2C0lytfiPF_DBgB&dv3_ver=m202309260101&rfl=http%3A%2F%2Fwelovesa.com%2F&ds=l&xdt=1&iif=1&cor=9300594981998146000&adk=2124396030&idt=212&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 14:17:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440529
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 14:17:59 GMT

GET
H/1.1 200
OK g2gqt23fm9fm Show response
hal9000.redintelligence.net/zone/ Frame 9751 11 KB
4 KB 38ms
13ms Script
text/html 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g2gqt23fm9fm?subid=&gdpr=&gdpr_consent=&rnd=1698856807086981&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCaiAZ39CZcWnBYKlngWfraGYD6blvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCerobIFe3sT6oAwHIA5sEqgTtAU_Qigqwj_8bcnjyJBUYLxzH7VlCXj1eAXXyugVXdRiFc4ws93zEtTBRYxNPkBeHusZFu0IBW83k2dabcDyx4QYFnCTAOjkQ_htY_TTf2qZKslxAMo3KMivU2TXB-aegodLlIsqD47IqVD4ZpVCy9y5bip5suBGXDCs9pUsNd8j6vEcAJqCRIOlOunsy5Xt4u5-J1_Mli3VjevspfTUj7J9AhL-zy0JNndTMVoBMh2Lje7E283AV0vdTXwniHX6hUQ9zARz9yoT20jHzEEGFQSOmEtyJK2v1uAmX4LNv5O47wiDuVVB3NE8YMdUdbMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwDICaaNOgYlrYT-1p5fnyWi-Y2bpPNFOeLFqjObFrsmIF02N7CxcsNKH0_BVjhCHujJVtYbfBoicdDifH4StJDYp2C0lytfiPF_DBgB%26sig%3DAOD64_32MgzBN3B8SNBGmYVe03HtRvoKXg%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-A8y9Kyp0Cbsn4ZA8E4xFke8Lpmit6j_fG-5E1n6-MoaAR1kdwi8k_PPfUIXeS8rbCu3FzcKeqo71L1Y7T59P5NwdQAIIvBC1xKQLpFxcpsn9G4sLqP-3tU62PvwoumC7p7l3VicWnq2xvUIRzQuqnKgb1IAlRD2epPORqP7bva75BlGWc%26cry%3D1%26dbm_d%3DAKAmf-Ck-44kXdpuuBw2p3hUaLqZWwqzpQVsnay-iJZ_SDMLV5FAdWMg1KFAZz3YEt8kN4nHW3PHYp7mQS7Xc9DeHGCXIdLDgxBsDp6YfltrtijEmEvFgvPTDXzw-i2V2nYNS9b4Oic7arRFEGnzMgMMyLR1uuLdBjW2DZT-tmbCBTbiH9y-h4uBOM7ll_uWjkpdTWBZy22j5k0bV_WKWPxaIqKRWuHjsURioTkFIW5Xw5qRzzFaoBZokIHpHGltuRv0eqfFJz0t50kxauYRs1Idziyc6RygvM8G7RdoFXXl030to5gFJesfaRQK_nK_gsgLqroPB06MYDrdKRYaJC0QyDtwkyYDqz5h62BIpEf31j6u2mDUtgWGC0NasTvZ5y0kEW2n2dpdDw2DPD5ifQqKmeBs6jLUWKi2Rudr09VESyPsA2nrxIKKzokW_EmW1D-7zSRptUe4q6-Ufr9XVGE2XqOYxE11m1SPEjF7sdA_VKSBZ3Vu0o-fG3NDulwLH49Gu0RxdAvB_TFWYCii48Gdt5NNxqYL7QYpHAJ7mbwRQXn0DwEfwyw%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6889194874109189&output=html&h=230&slotname=5203004128&adk=2298390012&adf=2458201212&pi=t.ma~as.5203004128&w=230&lmt=1698853206&format=230x230&url=http%3A%2F%2Fwelovesa.com%2F&wgl=1&dt=1698856806725&bpp=1&bdt=1017&idt=239&shv=r20231030&mjsv=m202310260102&ptt=9&saldr=aa&abxe=1&prev_fmts=230x230&correlator=5427695026629&frm=20&pv=1&ga_vid=1588780793.1698856807&ga_sid=1698856807&ga_hid=270415104&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=995&ady=523&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44804684%2C44805933%2C44807047%2C31078301%2C44803793&oid=2&pvsid=167788749781831&tmod=468553227&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=23&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=nblX1mT6P7&p=http%3A//welovesa.com&dtd=249
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: ece9119940403eca3459497f9c25291501160395acc1eecb828e7fa0e9e2e0e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Wed, 01 Nov 2023 16:40:08 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4154
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame C762 38 KB
13 KB 14ms
13ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 440507
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 14:18:21 GMT
expires: Sat, 26 Oct 2024 14:18:21 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request.php Show response
hal900024.redintelligence.net/ Frame 9751 3 KB
2 KB 149ms
85ms Script
application/x-javascript 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=e83a8f51f0&subid=&uid=817b7085c922cac8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCaiAZ39CZcWnBYKlngWfraGYD6blvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCerobIFe3sT6oAwHIA5sEqgTtAU_Qigqwj_8bcnjyJBUYLxzH7VlCXj1eAXXyugVXdRiFc4ws93zEtTBRYxNPkBeHusZFu0IBW83k2dabcDyx4QYFnCTAOjkQ_htY_TTf2qZKslxAMo3KMivU2TXB-aegodLlIsqD47IqVD4ZpVCy9y5bip5suBGXDCs9pUsNd8j6vEcAJqCRIOlOunsy5Xt4u5-J1_Mli3VjevspfTUj7J9AhL-zy0JNndTMVoBMh2Lje7E283AV0vdTXwniHX6hUQ9zARz9yoT20jHzEEGFQSOmEtyJK2v1uAmX4LNv5O47wiDuVVB3NE8YMdUdbMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwDICaaNOgYlrYT-1p5fnyWi-Y2bpPNFOeLFqjObFrsmIF02N7CxcsNKH0_BVjhCHujJVtYbfBoicdDifH4StJDYp2C0lytfiPF_DBgB%26sig%3DAOD64_32MgzBN3B8SNBGmYVe03HtRvoKXg%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-A8y9Kyp0Cbsn4ZA8E4xFke8Lpmit6j_fG-5E1n6-MoaAR1kdwi8k_PPfUIXeS8rbCu3FzcKeqo71L1Y7T59P5NwdQAIIvBC1xKQLpFxcpsn9G4sLqP-3tU62PvwoumC7p7l3VicWnq2xvUIRzQuqnKgb1IAlRD2epPORqP7bva75BlGWc%26cry%3D1%26dbm_d%3DAKAmf-Ck-44kXdpuuBw2p3hUaLqZWwqzpQVsnay-iJZ_SDMLV5FAdWMg1KFAZz3YEt8kN4nHW3PHYp7mQS7Xc9DeHGCXIdLDgxBsDp6YfltrtijEmEvFgvPTDXzw-i2V2nYNS9b4Oic7arRFEGnzMgMMyLR1uuLdBjW2DZT-tmbCBTbiH9y-h4uBOM7ll_uWjkpdTWBZy22j5k0bV_WKWPxaIqKRWuHjsURioTkFIW5Xw5qRzzFaoBZokIHpHGltuRv0eqfFJz0t50kxauYRs1Idziyc6RygvM8G7RdoFXXl030to5gFJesfaRQK_nK_gsgLqroPB06MYDrdKRYaJC0QyDtwkyYDqz5h62BIpEf31j6u2mDUtgWGC0NasTvZ5y0kEW2n2dpdDw2DPD5ifQqKmeBs6jLUWKi2Rudr09VESyPsA2nrxIKKzokW_EmW1D-7zSRptUe4q6-Ufr9XVGE2XqOYxE11m1SPEjF7sdA_VKSBZ3Vu0o-fG3NDulwLH49Gu0RxdAvB_TFWYCii48Gdt5NNxqYL7QYpHAJ7mbwRQXn0DwEfwyw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6889194874109189%26output%3Dhtml%26h%3D230%26slotname%3D5203004128%26adk%3D2298390012%26adf%3D2458201212%26pi%3Dt.ma~as.5203004128%26w%3D230%26lmt%3D1698853206%26format%3D230x230%26url%3Dhttp%253A%252F%252Fwelovesa.com%252F%26wgl%3D1%26dt%3D1698856806725%26bpp%3D1%26bdt%3D1017%26idt%3D239%26shv%3Dr20231030%26mjsv%3Dm202310260102%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D230x230%26correlator%3D5427695026629%26frm%3D20%26pv%3D1%26ga_vid%3D1588780793.1698856807%26ga_sid%3D1698856807%26ga_hid%3D270415104%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D995%26ady%3D523%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C44804684%252C44805933%252C44807047%252C31078301%252C44803793%26oid%3D2%26pvsid%3D167788749781831%26tmod%3D468553227%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CeE%257Cn%26abl%3DXS%26pfx%3D0%26fu%3D0%26bc%3D23%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D2%26uci%3Da!2%26fsb%3D1%26xpc%3DnblX1mT6P7%26p%3Dhttp%253A%2F%2Fwelovesa.com%26dtd%3D249&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fwelovesa.com&random=6588691379621&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/g2gqt23fm9fm?subid=&gdpr=&gdpr_consent=&rnd=1698856807086981&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCaiAZ39CZcWnBYKlngWfraGYD6blvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCerobIFe3sT6oAwHIA5sEqgTtAU_Qigqwj_8bcnjyJBUYLxzH7VlCXj1eAXXyugVXdRiFc4ws93zEtTBRYxNPkBeHusZFu0IBW83k2dabcDyx4QYFnCTAOjkQ_htY_TTf2qZKslxAMo3KMivU2TXB-aegodLlIsqD47IqVD4ZpVCy9y5bip5suBGXDCs9pUsNd8j6vEcAJqCRIOlOunsy5Xt4u5-J1_Mli3VjevspfTUj7J9AhL-zy0JNndTMVoBMh2Lje7E283AV0vdTXwniHX6hUQ9zARz9yoT20jHzEEGFQSOmEtyJK2v1uAmX4LNv5O47wiDuVVB3NE8YMdUdbMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwDICaaNOgYlrYT-1p5fnyWi-Y2bpPNFOeLFqjObFrsmIF02N7CxcsNKH0_BVjhCHujJVtYbfBoicdDifH4StJDYp2C0lytfiPF_DBgB%26sig%3DAOD64_32MgzBN3B8SNBGmYVe03HtRvoKXg%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-A8y9Kyp0Cbsn4ZA8E4xFke8Lpmit6j_fG-5E1n6-MoaAR1kdwi8k_PPfUIXeS8rbCu3FzcKeqo71L1Y7T59P5NwdQAIIvBC1xKQLpFxcpsn9G4sLqP-3tU62PvwoumC7p7l3VicWnq2xvUIRzQuqnKgb1IAlRD2epPORqP7bva75BlGWc%26cry%3D1%26dbm_d%3DAKAmf-Ck-44kXdpuuBw2p3hUaLqZWwqzpQVsnay-iJZ_SDMLV5FAdWMg1KFAZz3YEt8kN4nHW3PHYp7mQS7Xc9DeHGCXIdLDgxBsDp6YfltrtijEmEvFgvPTDXzw-i2V2nYNS9b4Oic7arRFEGnzMgMMyLR1uuLdBjW2DZT-tmbCBTbiH9y-h4uBOM7ll_uWjkpdTWBZy22j5k0bV_WKWPxaIqKRWuHjsURioTkFIW5Xw5qRzzFaoBZokIHpHGltuRv0eqfFJz0t50kxauYRs1Idziyc6RygvM8G7RdoFXXl030to5gFJesfaRQK_nK_gsgLqroPB06MYDrdKRYaJC0QyDtwkyYDqz5h62BIpEf31j6u2mDUtgWGC0NasTvZ5y0kEW2n2dpdDw2DPD5ifQqKmeBs6jLUWKi2Rudr09VESyPsA2nrxIKKzokW_EmW1D-7zSRptUe4q6-Ufr9XVGE2XqOYxE11m1SPEjF7sdA_VKSBZ3Vu0o-fG3NDulwLH49Gu0RxdAvB_TFWYCii48Gdt5NNxqYL7QYpHAJ7mbwRQXn0DwEfwyw%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a18791a755f268a128f6c4ee65a657fb4f19bc9757ce72f5ac1ff688ac448617

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 01 Nov 2023 16:40:08 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 78828000141460804444992012495024
Connection: close
Content-Length: 1132
Expires: Wed, 01 Nov 2023 16:40:08 +0100

GET
H3 200 mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js Show response
pagead2.googlesyndication.com/bg/ Frame C762 38 KB
15 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99235240097ffe1c3ccf93f0275840df66a62f6ce406788402b06df413755d67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 15:45:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3292
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15010
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 31 Oct 2024 15:45:16 GMT

GET
H/1.1 200
OK e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame 4260 0
616 B 140ms
73ms Document
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=62038500125864904444992012495007&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=596a14bd37&subid=&uid=7eda4ad276ad2a7c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7-jJZ39CZdahBJbziQPiyprQCqblvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCUyplZI6ysT6oAwHIA5sEqgTkAU_QkQpzXfqU6yeSJHjixq5y6YqNAUUrmXY_RGLqRAM8CAPieMshyb_bbI8oz1z9cZvZgzjFngweDDs39BlNJxh0vYnAXcMrz_DdK6JS0qeIbH6y4HDQo5jidF3H4acUJT58buQjPSpJUwSiuOO20BsOCEI4vYuo_OtFqfuKMUzkKjT3To0R6K2sYYTrOa5qsm4pGVnStt0bt3bUQzlKjQhBqdDQ3jUHhSyma_HkchM2QRKjpbtX-av-7qkCXKMpdsmSwIuwPDYD4oZUV5sQ34cw5hSz4dSZnql6I6nPSNXl5FBSXMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADICaaNvDRA4Po7HF8x38ZUflTYjILsluf0VrWzhQB2VhpxgqTkaA5LAKw-zpI7R0YndEr0tGHRW8Jj6p4-dUh_ObSG3JV3dNcsaGsYAQ%26sig%3DAOD64_11O61oI76HMkI-OjiTX0CeltSang%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-CTgQY9QxvInYJUvzZwx9YzP78Pohz2AHRcsbeG45rkMbvbFh9iJFT4wKd3EsinN4v2-UZYWy1TjTUyNQBFqMdimBz0IXbsdDnBwu0ZzGRoi47dZfxg7UICugTvCcjWJjRgQH2yodlyqrhU9-XW-JGRCWB77KBBI-0eGJk_CFNalKp6KAk%26cry%3D1%26dbm_d%3DAKAmf-Cb6FPOqXUDEpRGso9uzVI_CYmY6kM72uNm7V-2nQ8d4ZmGBQz7FxDueodbjHkgp2yy6YRoFhhDHzS14_OtmT05yE__ggFY2fKuf1bKmmP2FVLKhg_-gNAOEUcR9ec1DSAotYE3YgMtIL5aPlenTkAsenNIeZK9pTfv20Yl0FmmxcNYo3MRn_DWWkHd3Oxw7GcYlgIt4X2Fk8Z2P0zObdGNFsxVBT5qKzEP5JJhg6vw3R1atZQruZHT8lE8KbFGE2qV6AJgBHqbg4WrA7AM0jj-uDf4wnS6xk97yzS0hCp_zDzXYGGP6CgbPpMye2y79EpVjx8lPx2_zBEQ-hb7dCe4DdASXw-xYPGHGPWokrEZiZZJN0xE5oPhznwx2hsYHsIFSjBqANaQeY9yXhKkELM9V18zrVqPBSH6iMDKP4NWQWqym9Y1cEqHHaFh5FwLGo098bkSQv3ZKB0QSmiNWmubtiv6Vmxng1A2geVq9rtfn_HVm1Wl7CMoaZRlE2r81OvA5d2gGrROl6dBvYp-7hKJkZQ9XMwIxWH1Cpq_p0K5LKme2M4%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6889194874109189%26output%3Dhtml%26h%3D230%26slotname%3D5203004128%26adk%3D2298390012%26adf%3D2500649472%26pi%3Dt.ma~as.5203004128%26w%3D230%26lmt%3D1698853206%26format%3D230x230%26url%3Dhttp%253A%252F%252Fwelovesa.com%252F%26wgl%3D1%26dt%3D1698856806721%26bpp%3D4%26bdt%3D1012%26idt%3D206%26shv%3Dr20231030%26mjsv%3Dm202310260102%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D5427695026629%26frm%3D20%26pv%3D2%26ga_vid%3D1588780793.1698856807%26ga_sid%3D1698856807%26ga_hid%3D270415104%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D995%26ady%3D293%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C44804684%252C44805933%252C44807047%252C31078301%252C44803793%26oid%3D2%26pvsid%3D167788749781831%26tmod%3D468553227%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CeE%257Cn%26abl%3DXS%26pfx%3D0%26fu%3D0%26bc%3D23%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DGIxmGdGpn7%26p%3Dhttp%253A%2F%2Fwelovesa.com%26dtd%3D237&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fwelovesa.com&random=8484240025875&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"SourceEventId":"17200521800104416","Destination":"https://trck.easy-m.de","Expiry":5184000,"FilterData":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Wed, 01 Nov 2023 16:40:08 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: B2A2D18B:99E0_91EFC182:01BB_65427F68_6EDB2CF:1193E

GET
H2

200

activityi;dc_pre=CMX41OSeo4IDFXxHHgIdMtYKcQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=882378915322.8989 Show response
5994599.fls.doubleclick.net/ Frame 33F0
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=882378915322.8989?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CMX41OSeo4IDFXxHHgIdMtYKcQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=882378915322.8989?

391 B
327 B

68ms
60ms

Document
text/html

142.250.185.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CMX41OSeo4IDFXxHHgIdMtYKcQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=882378915322.8989?

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f6.1e100.net

Software

cafe /

Resource Hash

1368ddf74f3609b69519057fe0229f0817268a646c936e71676efaa35165426a

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:40:08 GMT
expires: Wed, 01 Nov 2023 16:40:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:40:08 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CMX41OSeo4IDFXxHHgIdMtYKcQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=882378915322.8989?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90007.redintelligence.net/ Frame 9B2F 6 KB
2 KB 52ms
14ms Document
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request_content.php?s=62038500125864904444992012495007&a=ba9e6646
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=596a14bd37&subid=&uid=7eda4ad276ad2a7c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7-jJZ39CZdahBJbziQPiyprQCqblvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCUyplZI6ysT6oAwHIA5sEqgTkAU_QkQpzXfqU6yeSJHjixq5y6YqNAUUrmXY_RGLqRAM8CAPieMshyb_bbI8oz1z9cZvZgzjFngweDDs39BlNJxh0vYnAXcMrz_DdK6JS0qeIbH6y4HDQo5jidF3H4acUJT58buQjPSpJUwSiuOO20BsOCEI4vYuo_OtFqfuKMUzkKjT3To0R6K2sYYTrOa5qsm4pGVnStt0bt3bUQzlKjQhBqdDQ3jUHhSyma_HkchM2QRKjpbtX-av-7qkCXKMpdsmSwIuwPDYD4oZUV5sQ34cw5hSz4dSZnql6I6nPSNXl5FBSXMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADICaaNvDRA4Po7HF8x38ZUflTYjILsluf0VrWzhQB2VhpxgqTkaA5LAKw-zpI7R0YndEr0tGHRW8Jj6p4-dUh_ObSG3JV3dNcsaGsYAQ%26sig%3DAOD64_11O61oI76HMkI-OjiTX0CeltSang%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-CTgQY9QxvInYJUvzZwx9YzP78Pohz2AHRcsbeG45rkMbvbFh9iJFT4wKd3EsinN4v2-UZYWy1TjTUyNQBFqMdimBz0IXbsdDnBwu0ZzGRoi47dZfxg7UICugTvCcjWJjRgQH2yodlyqrhU9-XW-JGRCWB77KBBI-0eGJk_CFNalKp6KAk%26cry%3D1%26dbm_d%3DAKAmf-Cb6FPOqXUDEpRGso9uzVI_CYmY6kM72uNm7V-2nQ8d4ZmGBQz7FxDueodbjHkgp2yy6YRoFhhDHzS14_OtmT05yE__ggFY2fKuf1bKmmP2FVLKhg_-gNAOEUcR9ec1DSAotYE3YgMtIL5aPlenTkAsenNIeZK9pTfv20Yl0FmmxcNYo3MRn_DWWkHd3Oxw7GcYlgIt4X2Fk8Z2P0zObdGNFsxVBT5qKzEP5JJhg6vw3R1atZQruZHT8lE8KbFGE2qV6AJgBHqbg4WrA7AM0jj-uDf4wnS6xk97yzS0hCp_zDzXYGGP6CgbPpMye2y79EpVjx8lPx2_zBEQ-hb7dCe4DdASXw-xYPGHGPWokrEZiZZJN0xE5oPhznwx2hsYHsIFSjBqANaQeY9yXhKkELM9V18zrVqPBSH6iMDKP4NWQWqym9Y1cEqHHaFh5FwLGo098bkSQv3ZKB0QSmiNWmubtiv6Vmxng1A2geVq9rtfn_HVm1Wl7CMoaZRlE2r81OvA5d2gGrROl6dBvYp-7hKJkZQ9XMwIxWH1Cpq_p0K5LKme2M4%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6889194874109189%26output%3Dhtml%26h%3D230%26slotname%3D5203004128%26adk%3D2298390012%26adf%3D2500649472%26pi%3Dt.ma~as.5203004128%26w%3D230%26lmt%3D1698853206%26format%3D230x230%26url%3Dhttp%253A%252F%252Fwelovesa.com%252F%26wgl%3D1%26dt%3D1698856806721%26bpp%3D4%26bdt%3D1012%26idt%3D206%26shv%3Dr20231030%26mjsv%3Dm202310260102%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26correlator%3D5427695026629%26frm%3D20%26pv%3D2%26ga_vid%3D1588780793.1698856807%26ga_sid%3D1698856807%26ga_hid%3D270415104%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D995%26ady%3D293%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C44804684%252C44805933%252C44807047%252C31078301%252C44803793%26oid%3D2%26pvsid%3D167788749781831%26tmod%3D468553227%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CeE%257Cn%26abl%3DXS%26pfx%3D0%26fu%3D0%26bc%3D23%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D1%26uci%3Da!1%26fsb%3D1%26xpc%3DGIxmGdGpn7%26p%3Dhttp%253A%2F%2Fwelovesa.com%26dtd%3D237&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fwelovesa.com&random=8484240025875&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c5bb43218989117d6964f6de05d2d99db35197d6729550dd51bea04f0af6e3e1

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 1877
Content-Type: text/html; charset=utf-8
Date: Wed, 01 Nov 2023 16:40:08 GMT
Expires: Wed, 01 Nov 2023 16:40:08 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame A897
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=62038500125864904444992012495007&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=62038500125864904444992012495007&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
632 B

72ms
36ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=62038500125864904444992012495007&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:08 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"SourceEventId":"17200521800104416","Destination":"https://trck.easy-m.de","Expiry":5184000,"FilterData":{}}
server: nginx
host: pv.medialead.de
x-iplb-request-id: B2A2D18B:99E0_91EFC182:01BB_65427F68_6EDB2DB:1193E
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=62038500125864904444992012495007&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Wed, 01 Nov 2023 16:40:08 GMT
server: nginx
content-length: 154
content-type: text/html

GET
DATA 200
OK truncated
/ Frame A897 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a951480ddbbdcd2154e196aba18bb9be0f7be9b56857122829c1d72dbb6d851a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ Frame 9B2F 5 KB
1 KB 91ms
24ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=62038500125864904444992012495007&a=ba9e6646

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 01 Nov 2023 16:40:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 01 Nov 2023 15:20:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Nov 2023 16:40:08 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 9B2F 64 KB
64 KB 37ms
13ms Image
image/png 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=62038500125864904444992012495007&a=ba9e6646
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 2e722adc12fa406bf9db41a39bd09fc975409c4cfef06efb27e847805e7507d2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Wed, 01 Nov 2023 16:40:08 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: image/png

GET
H2 200 / Show response
adv.office-partner.de/ Frame 9DCB 930 B
923 B 299ms
12ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=e83a8f51f0&subid=&uid=817b7085c922cac8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCaiAZ39CZcWnBYKlngWfraGYD6blvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCerobIFe3sT6oAwHIA5sEqgTtAU_Qigqwj_8bcnjyJBUYLxzH7VlCXj1eAXXyugVXdRiFc4ws93zEtTBRYxNPkBeHusZFu0IBW83k2dabcDyx4QYFnCTAOjkQ_htY_TTf2qZKslxAMo3KMivU2TXB-aegodLlIsqD47IqVD4ZpVCy9y5bip5suBGXDCs9pUsNd8j6vEcAJqCRIOlOunsy5Xt4u5-J1_Mli3VjevspfTUj7J9AhL-zy0JNndTMVoBMh2Lje7E283AV0vdTXwniHX6hUQ9zARz9yoT20jHzEEGFQSOmEtyJK2v1uAmX4LNv5O47wiDuVVB3NE8YMdUdbMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwDICaaNOgYlrYT-1p5fnyWi-Y2bpPNFOeLFqjObFrsmIF02N7CxcsNKH0_BVjhCHujJVtYbfBoicdDifH4StJDYp2C0lytfiPF_DBgB%26sig%3DAOD64_32MgzBN3B8SNBGmYVe03HtRvoKXg%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-A8y9Kyp0Cbsn4ZA8E4xFke8Lpmit6j_fG-5E1n6-MoaAR1kdwi8k_PPfUIXeS8rbCu3FzcKeqo71L1Y7T59P5NwdQAIIvBC1xKQLpFxcpsn9G4sLqP-3tU62PvwoumC7p7l3VicWnq2xvUIRzQuqnKgb1IAlRD2epPORqP7bva75BlGWc%26cry%3D1%26dbm_d%3DAKAmf-Ck-44kXdpuuBw2p3hUaLqZWwqzpQVsnay-iJZ_SDMLV5FAdWMg1KFAZz3YEt8kN4nHW3PHYp7mQS7Xc9DeHGCXIdLDgxBsDp6YfltrtijEmEvFgvPTDXzw-i2V2nYNS9b4Oic7arRFEGnzMgMMyLR1uuLdBjW2DZT-tmbCBTbiH9y-h4uBOM7ll_uWjkpdTWBZy22j5k0bV_WKWPxaIqKRWuHjsURioTkFIW5Xw5qRzzFaoBZokIHpHGltuRv0eqfFJz0t50kxauYRs1Idziyc6RygvM8G7RdoFXXl030to5gFJesfaRQK_nK_gsgLqroPB06MYDrdKRYaJC0QyDtwkyYDqz5h62BIpEf31j6u2mDUtgWGC0NasTvZ5y0kEW2n2dpdDw2DPD5ifQqKmeBs6jLUWKi2Rudr09VESyPsA2nrxIKKzokW_EmW1D-7zSRptUe4q6-Ufr9XVGE2XqOYxE11m1SPEjF7sdA_VKSBZ3Vu0o-fG3NDulwLH49Gu0RxdAvB_TFWYCii48Gdt5NNxqYL7QYpHAJ7mbwRQXn0DwEfwyw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6889194874109189%26output%3Dhtml%26h%3D230%26slotname%3D5203004128%26adk%3D2298390012%26adf%3D2458201212%26pi%3Dt.ma~as.5203004128%26w%3D230%26lmt%3D1698853206%26format%3D230x230%26url%3Dhttp%253A%252F%252Fwelovesa.com%252F%26wgl%3D1%26dt%3D1698856806725%26bpp%3D1%26bdt%3D1017%26idt%3D239%26shv%3Dr20231030%26mjsv%3Dm202310260102%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D230x230%26correlator%3D5427695026629%26frm%3D20%26pv%3D1%26ga_vid%3D1588780793.1698856807%26ga_sid%3D1698856807%26ga_hid%3D270415104%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D995%26ady%3D523%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C44804684%252C44805933%252C44807047%252C31078301%252C44803793%26oid%3D2%26pvsid%3D167788749781831%26tmod%3D468553227%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CeE%257Cn%26abl%3DXS%26pfx%3D0%26fu%3D0%26bc%3D23%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D2%26uci%3Da!2%26fsb%3D1%26xpc%3DnblX1mT6P7%26p%3Dhttp%253A%2F%2Fwelovesa.com%26dtd%3D249&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fwelovesa.com&random=6588691379621&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Wed, 01 Nov 2023 16:40:08 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Wed, 08 Nov 2023 16:40:08 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 9751 2 KB
2 KB 387ms
90ms Script
text/html 13.43.153.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=78828000141460804444992012495024&nw=1
Requested by: Host: welovesa.com
URL: http://welovesa.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.153.42 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-153-42.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 27b0287890b02b4d65299e482c47ac73acabba989985b19be0e621ad78c42074

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:08 GMT
last-modified: Wed, 01 Nov 2023 16:40:08 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Wed, 01 Nov 2023 16:41:08 GMT

GET
H2

200

activityi;dc_pre=CL6z1-Seo4IDFTZZwgodvqYMxA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9531358070456.623 Show response
5994599.fls.doubleclick.net/ Frame 29B6
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9531358070456.623?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CL6z1-Seo4IDFTZZwgodvqYMxA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9531358070456.623?

391 B
284 B

276ms
60ms

Document
text/html

142.250.185.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CL6z1-Seo4IDFTZZwgodvqYMxA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9531358070456.623?

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f6.1e100.net

Software

cafe /

Resource Hash

4f17ce8598064b65daf079fdb9419edcb162096dc3f80cce83af770d6ee43136

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:40:08 GMT
expires: Wed, 01 Nov 2023 16:40:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:40:08 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CL6z1-Seo4IDFTZZwgodvqYMxA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9531358070456.623?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900024.redintelligence.net/ Frame A9BB 6 KB
2 KB 49ms
12ms Document
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request_content.php?s=78828000141460804444992012495024&a=1df0e664
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=e83a8f51f0&subid=&uid=817b7085c922cac8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCaiAZ39CZcWnBYKlngWfraGYD6blvaBppZGcp8kP8C4QASCdy7AaYJWqoIKwB8gBCakCerobIFe3sT6oAwHIA5sEqgTtAU_Qigqwj_8bcnjyJBUYLxzH7VlCXj1eAXXyugVXdRiFc4ws93zEtTBRYxNPkBeHusZFu0IBW83k2dabcDyx4QYFnCTAOjkQ_htY_TTf2qZKslxAMo3KMivU2TXB-aegodLlIsqD47IqVD4ZpVCy9y5bip5suBGXDCs9pUsNd8j6vEcAJqCRIOlOunsy5Xt4u5-J1_Mli3VjevspfTUj7J9AhL-zy0JNndTMVoBMh2Lje7E283AV0vdTXwniHX6hUQ9zARz9yoT20jHzEEGFQSOmEtyJK2v1uAmX4LNv5O47wiDuVVB3NE8YMdUdbMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaIMDCoKCgjktLEC7rWxAqoNAkRFsBP6vLAV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwDICaaNOgYlrYT-1p5fnyWi-Y2bpPNFOeLFqjObFrsmIF02N7CxcsNKH0_BVjhCHujJVtYbfBoicdDifH4StJDYp2C0lytfiPF_DBgB%26sig%3DAOD64_32MgzBN3B8SNBGmYVe03HtRvoKXg%26client%3Dca-pub-6889194874109189%26dbm_c%3DAKAmf-A8y9Kyp0Cbsn4ZA8E4xFke8Lpmit6j_fG-5E1n6-MoaAR1kdwi8k_PPfUIXeS8rbCu3FzcKeqo71L1Y7T59P5NwdQAIIvBC1xKQLpFxcpsn9G4sLqP-3tU62PvwoumC7p7l3VicWnq2xvUIRzQuqnKgb1IAlRD2epPORqP7bva75BlGWc%26cry%3D1%26dbm_d%3DAKAmf-Ck-44kXdpuuBw2p3hUaLqZWwqzpQVsnay-iJZ_SDMLV5FAdWMg1KFAZz3YEt8kN4nHW3PHYp7mQS7Xc9DeHGCXIdLDgxBsDp6YfltrtijEmEvFgvPTDXzw-i2V2nYNS9b4Oic7arRFEGnzMgMMyLR1uuLdBjW2DZT-tmbCBTbiH9y-h4uBOM7ll_uWjkpdTWBZy22j5k0bV_WKWPxaIqKRWuHjsURioTkFIW5Xw5qRzzFaoBZokIHpHGltuRv0eqfFJz0t50kxauYRs1Idziyc6RygvM8G7RdoFXXl030to5gFJesfaRQK_nK_gsgLqroPB06MYDrdKRYaJC0QyDtwkyYDqz5h62BIpEf31j6u2mDUtgWGC0NasTvZ5y0kEW2n2dpdDw2DPD5ifQqKmeBs6jLUWKi2Rudr09VESyPsA2nrxIKKzokW_EmW1D-7zSRptUe4q6-Ufr9XVGE2XqOYxE11m1SPEjF7sdA_VKSBZ3Vu0o-fG3NDulwLH49Gu0RxdAvB_TFWYCii48Gdt5NNxqYL7QYpHAJ7mbwRQXn0DwEfwyw%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6889194874109189%26output%3Dhtml%26h%3D230%26slotname%3D5203004128%26adk%3D2298390012%26adf%3D2458201212%26pi%3Dt.ma~as.5203004128%26w%3D230%26lmt%3D1698853206%26format%3D230x230%26url%3Dhttp%253A%252F%252Fwelovesa.com%252F%26wgl%3D1%26dt%3D1698856806725%26bpp%3D1%26bdt%3D1017%26idt%3D239%26shv%3Dr20231030%26mjsv%3Dm202310260102%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D230x230%26correlator%3D5427695026629%26frm%3D20%26pv%3D1%26ga_vid%3D1588780793.1698856807%26ga_sid%3D1698856807%26ga_hid%3D270415104%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26adx%3D995%26ady%3D523%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C44804684%252C44805933%252C44807047%252C31078301%252C44803793%26oid%3D2%26pvsid%3D167788749781831%26tmod%3D468553227%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3Dd%257C%257CeE%257Cn%26abl%3DXS%26pfx%3D0%26fu%3D0%26bc%3D23%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D2%26uci%3Da!2%26fsb%3D1%26xpc%3DnblX1mT6P7%26p%3Dhttp%253A%2F%2Fwelovesa.com%26dtd%3D249&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttp%3A%2F%2Fwelovesa.com&random=6588691379621&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 1a242dacb538ba2e5931b29e595cedc1cef1881a7f8e7885875317b131864d85

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 1874
Content-Type: text/html; charset=utf-8
Date: Wed, 01 Nov 2023 16:40:08 GMT
Expires: Wed, 01 Nov 2023 16:40:08 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 9751 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aacc4d6064d32f7fcb3a4aa1c8411b2e490188f41015583b7e31a9bc0870517f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ Frame A9BB 5 KB
755 B 24ms
23ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=78828000141460804444992012495024&a=1df0e664

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 01 Nov 2023 16:40:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 01 Nov 2023 15:30:35 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Nov 2023 16:40:08 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame A9BB 57 KB
57 KB 37ms
14ms Image
image/png 78.46.90.238
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=78828000141460804444992012495024&a=1df0e664
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.90.238 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.238.90.46.78.clients.your-server.de
Software: Apache /
Resource Hash: deea4fa1474758abad967850d3faa6e2249e5934eb5bf5beea0feea6fa59cc71

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Wed, 01 Nov 2023 16:40:08 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 57892
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal90007.redintelligence.net/ Frame 9B2F 0
150 B 36ms
12ms Script
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/viewability?s=62038500125864904444992012495007&a=f9bf8e7a&vb=m
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=62038500125864904444992012495007&a=ba9e6646
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/request_content.php?s=62038500125864904444992012495007&a=ba9e6646
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Wed, 01 Nov 2023 16:40:08 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 9B2F 14 KB
15 KB 185ms
18ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90007.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 16:23:45 GMT
x-content-type-options: nosniff
age: 519383
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 25 Oct 2024 16:23:45 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 9B2F 15 KB
15 KB 200ms
33ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90007.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 459431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 09:02:57 GMT

GET
H/1.1 200
OK viewability Show response
hal900024.redintelligence.net/ Frame A9BB 0
150 B 36ms
12ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/viewability?s=78828000141460804444992012495024&a=fa7f606e&vb=m
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=78828000141460804444992012495024&a=1df0e664
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/request_content.php?s=78828000141460804444992012495024&a=1df0e664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Wed, 01 Nov 2023 16:40:08 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 718E 0
20 B 55ms
53ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BPM1rZ39CZfi_L4nZ3wPtwpCoBwAAAAA4AeAEAg&bg=!trWltfrNAAbo5yKYyOc7ADQBe5WfODm4wmHbeaZYjZ0sajUm34bU_n68mkKyE4JeEoGh01OJRc2XgHmxKEYDKGVhkhQQAgAAAWhSAAAAGmgBB5kDATr55ZnoR4s7FyD8sKTONLGAGvw8VXZXHbqhWMR8kdIKV7p1apTvNeL8b3mm7p3yVfO7G_nZhDdaXquM1zB7hCLvAMCufhjum6XrUF1HDfby-YEdAUG5vImDkupiHhnVpgku-DdwJT1D6wYNVuHeBl2mUkLdnMv50FDvFcEN6cXTQGvTnr1WbkivS22J6EcD9GcVJEX1ypXjThNer8IrGXyOOvHiy9Eejh6mVcD6l32v_zjoUloijK-k71582r6_-5rJ8HnhyXc3Y0WWZdqqyrMbL82-mHB77Ine06FNOfkDx3joLVozowFwLVc-c0kfyyxjftctmSmo542Z-LGIi9ASlUT1RLyuc8WqdkkxWfDcRObkFSaGbIH80vfKmywIC5a9SwA7mdlUdxVK5-29ebdG4cObiMCUOfMuuSqZOK_Jb9Eg6N9Q084QpdYwc42LnBn9WpU53t8ZBZgmoFNVNgFmvC-Fy3FbJPhW3l3qSwikIT-bdpT6-jG_FLMR8MdEiAqNkhHn5hM4nRqcdT7_YAFxp5mEAwf7FnaYFKmGzikR-wJaPm5Sdl09YlN2fQfLFBLfvohVv8K5vp-X8trg7PYUoy3seqzC97WgS883WNddSlEiZLUGO1kB9Z-q1PsUZQo8e3T10-JWEL_2vzKAGrZXGSvFwl6dE-rnbBks9L61XqjdJnv0QuDyYDGvUOF3otjX0qiYnOzbF08OJNR0mMNhuFtUXDIWhDDrBFqDzew8hjGA2DTwyh-NUmbmAwXK4fkThReYq8Epi6Dvzb0TJLqFhh0dF_HOc_oK0NVSYs0nKMHQ2Feu8TEe49J517sY0n1EsQ5Zcqgc3_op2Q9s2ue1fPefc1hiPKO85uYFsV_kU2H5h2gTlQocFfvxI0Ktdg0LDP_vGqxdsOxmDTBCOr_PcqJgtvrFI_Pi5GKURoGqPXAY50MqjejXbN0fRLjQX4zhbx5QSjzIR_qOnaRWK66dZ3eDf7ruYM6DXzds6uunXvWz3QlJx0zhoHKt6LeVxSM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame A9BB 14 KB
15 KB 170ms
22ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900024.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 16:23:45 GMT
x-content-type-options: nosniff
age: 519383
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 25 Oct 2024 16:23:45 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame A9BB 15 KB
15 KB 187ms
40ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900024.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 459431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 09:02:57 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C762 0
20 B 51ms
51ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=ByBOyZ39CZc7GMcStrASz46ewBwAAAAA4AeAEAg&bg=!wcKlwo3NAAbo5yKYyOc7ADQBe5WfOIQCeVaPy1TPSaarGxw6DHCQBQHzSOHapRMbgaTOd3EVqGj2HfxX7R05O6qpOmKrAgAAAX9SAAAAC2gBB5kDBpL2q0ilIdIJqEUkqBFdu8lHAVFjXwgQw45LIYr5m6dhgHo4f0m0_EnwrPXHQc8KetyyZ0JvnK2Qp-GpYCazQlOYU9bITW2nwTy0PQksO9xHClogpLXeAUHpdTRAMwrYNtnrUH_Cj6nZrG4Flou74H7cDXf9Bqe-beHssMAhhZP8iOCjpyVMyeMNV1Y7PTn7aZVBxzzZW3blob7t8876cttOmOLhUcOA5Ph7xK2VCde1OXeNXWzeBxkRGw3l5jKc6U3Hf5YtZbPCC0N1hFRaLDPIRf6tJj5jUclHXBUEfzkn1TXrFk73JBxSXpdPOTzGC33EdZnQATvVcuuv8qv7q8NuxP1M69giI_avAlOZS44WyDGp6vQQzZWEVLT8IT8JXjcCw38xV5m9EVNAqOuxoGR8-MNdc9uHHd-ODrgnG3X2dHatIaMy6rR07yDz7I9JCAOc1DD7AzeY-RnjKpXRHddqAAFPx_-CHPCXJxTW_Sl6nOhWGTDXjluc4h5LXG7gKVpJleNHRaiUlmcK1n170tcDnmislYesW2spa1Ly4ErEEBrssz63MWR-eB37i9PRLpnxZDAbyqdKhZGrwp37jd9I_XhDhEfvBRwbvxMInpcRUQ9UopsuOLpZGNMAkldkKijkwYBHazH0JizfrRhW6pWzpsduEKjbDT3P0e3qFFTsDKm0SXrnOWFTdg54csN7Eorc1er1coIHAx1ctGFEkiMRQWdX3V1hcFykPJXvE-prys8jeWbt5M6GXOaFsi9NWRtlvr4sxKRi7yx5r3aLcNvRIHhG6p3tptrsaesdjgE4srMoNv9JhfO0P4Uqh33JOMvnGC8ZAYk2kB0WOnMsMdpU8hV0cVDk8h_SgyVIGkG8Pnu1oPbc8cZteicqoVUi0kEIVtooSqwE4paiGuhxSbDfrJpLfH0xsMHMn8gc8IIWdEY_jsY6cFfytNloJl5LFnLrlMYuqHqBUwwEB-2z0DJS4qHGzlfaAi6_hPnXXpRONyLwG7C4P3hl-o1zCoKj_1Ib0fHMAQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6889194874109189&output=html&h=230&slotname=5203004128&adk=2298390012&adf=2458201212&pi=t.ma~as.5203004128&w=230&lmt=1698853206&format=230x230&url=http%3A%2F%2Fwelovesa.com%2F&wgl=1&dt=1698856806725&bpp=1&bdt=1017&idt=239&shv=r20231030&mjsv=m202310260102&ptt=9&saldr=aa&abxe=1&prev_fmts=230x230&correlator=5427695026629&frm=20&pv=1&ga_vid=1588780793.1698856807&ga_sid=1698856807&ga_hid=270415104&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=995&ady=523&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44804684%2C44805933%2C44807047%2C31078301%2C44803793&oid=2&pvsid=167788749781831&tmod=468553227&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=23&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=nblX1mT6P7&p=http%3A//welovesa.com&dtd=249

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CMX41OSeo4IDFXxHHgIdMtYKcQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=882378915322.8989
adservice.google.com/ddm/fls/z/ Frame 33F0 42 B
401 B 125ms
53ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CMX41OSeo4IDFXxHHgIdMtYKcQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=882378915322.8989

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CMX41OSeo4IDFXxHHgIdMtYKcQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=882378915322.8989?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 9DCB 175 KB
62 KB 25ms
25ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ce680dc0d4d372a3859afb16a19de193139d7e175b3d86ba5f0ca804cdabb104

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63961
x-xss-protection: 0
last-modified: Wed, 01 Nov 2023 16:04:20 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 01 Nov 2023 16:40:08 GMT

GET
H2 200 dc_pre=CL6z1-Seo4IDFTZZwgodvqYMxA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9531358070456.623
adservice.google.com/ddm/fls/z/ Frame 29B6 42 B
107 B 63ms
53ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CL6z1-Seo4IDFTZZwgodvqYMxA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9531358070456.623

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CL6z1-Seo4IDFTZZwgodvqYMxA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9531358070456.623?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 9DCB 273 KB
91 KB 23ms
23ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d16cf8dc2b105058e0cd8bd55bc7c10f0e4e3123da66b5468bb39f9f83b33f7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92629
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 01 Nov 2023 16:40:08 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 9751 53 KB
19 KB 85ms
8ms Script
application/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=78828000141460804444992012495024&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 363775b6a36d37e4fe7fd331f1d9e5beba1004dca1336f33317199502910f72e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 06:34:19 GMT
content-encoding: gzip
via: 1.1 a3c1615d6bdfc01a05a0b3a742d10d38.cloudfront.net (CloudFront)
last-modified: Fri, 20 Oct 2023 11:11:17 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 36350
x-amz-server-side-encryption: AES256
etag: W/"0ae4c707fb82279f376a21c2c459fbfd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 97EcC082LtSlMkdfu8YyeDrC4i46H0f3tmY96-O-vXFlLNwrQ359pA==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame 9751 3 KB
3 KB 49ms
8ms Image
image/png 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1698857108&Signature=U-Xjym1HVbxvlhpQA7N7v6guS4b9VevNRvx43HWa~xrqUS4kiy85XEj2THo8656gKjS8H-a9W4mAPn-8WFn5X40w5fF7RXVx-bFWMCnoaVYM9x2cKdiY7B3nasNZTbQljiicUfA-fUy5I8VcNrcMDfoqIAHobtqWdk-XDAcWvGHFjAM-sHc1OQuibbPdFseTx8vCxCkpggB4PvW-bBrXqwrmX5BbT6K8VnddUtGhKsRLOMANO0B5NcSq8EqG9tWcrTJIhHMMIZdJKLk4tWHqAVN7dPn7b4npeSZpB4VwRBMToSNAWnPgl8-U4lUDhZB20auRun8OO4Fk8IB9QBcGWA__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6889194874109189&output=html&h=230&slotname=5203004128&adk=2298390012&adf=2458201212&pi=t.ma~as.5203004128&w=230&lmt=1698853206&format=230x230&url=http%3A%2F%2Fwelovesa.com%2F&wgl=1&dt=1698856806725&bpp=1&bdt=1017&idt=239&shv=r20231030&mjsv=m202310260102&ptt=9&saldr=aa&abxe=1&prev_fmts=230x230&correlator=5427695026629&frm=20&pv=1&ga_vid=1588780793.1698856807&ga_sid=1698856807&ga_hid=270415104&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=995&ady=523&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44804684%2C44805933%2C44807047%2C31078301%2C44803793&oid=2&pvsid=167788749781831&tmod=468553227&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=23&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&xpc=nblX1mT6P7&p=http%3A//welovesa.com&dtd=249
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-amz-version-id: null
date: Wed, 01 Nov 2023 07:39:15 GMT
via: 1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 69212
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: CXttwQINDWN97_sTVwTlb3lJNXUGVLkrIGJaP5cmFttMUpJ8h_IDYg==

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260102/ 160 KB
55 KB 454ms
453ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260102/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae4694dfdcbbcf4ea49d528862b014584e4bba47069b3f4d2e8bb8b60d5d3290

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://welovesa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55816
x-xss-protection: 0
server: cafe
etag: 13445568427160135064
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Nov 2023 16:40:09 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A897 42 B
64 B 290ms
122ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsslI-Y3XCd5ETht18pK2TTWBfJdrUoUVVWzCRv9MaJ-tRHnOszCgI3jl9ERKJZ5uk61YIQPTBKDHbvwdSUicA9JX5fC_CNgCWLQVEo1j5L8juLUOXR_BgTws1aIUb-Nhpo&sai=AMfl-YRXrLfiHNIOnqM6t8Rur43f6mSIvlKaFvJ6PyBp_cLMWNY0oYCgBA0lF9JJrMiFmJ9nZe4K66BKlZw1BWnu9Ji3lxVo4XfCmrqRDBTelEcTPruNzxneshrGHF6v3wXsiNJJbeB7MYn3YVHrAw&sig=Cg0ArKJSzO7UcCW_7LL1EAE&cid=CAQSTADICaaNvDRA4Po7HF8x38ZUflTYjILsluf0VrWzhQB2VhpxgqTkaA5LAKw-zpI7R0YndEr0tGHRW8Jj6p4-dUh_ObSG3JV3dNcsaGsYAQ&id=lidar2&mcvt=1000&p=0,0,200,200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231030&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2298390012&rs=2&la=0&cr=0&vs=4&r=v&rst=1698856807521&rpt=705&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal90007.redintelligence.net/ Frame 9B2F 0
150 B 45ms
17ms Script
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/viewability?s=62038500125864904444992012495007&a=f9bf8e7a&vb=v
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=62038500125864904444992012495007&a=ba9e6646
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/request_content.php?s=62038500125864904444992012495007&a=ba9e6646
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Wed, 01 Nov 2023 16:40:09 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK viewability Show response
hal900024.redintelligence.net/ Frame A9BB 0
150 B 45ms
18ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/viewability?s=78828000141460804444992012495024&a=fa7f606e&vb=v
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=78828000141460804444992012495024&a=1df0e664
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/request_content.php?s=78828000141460804444992012495024&a=1df0e664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Wed, 01 Nov 2023 16:40:09 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9751 42 B
64 B 123ms
122ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuvz370SowKoX8si-AMjC1IPj4SkTBa2GyG-FNQnm_GvKe7-GdVv61fu453GD-SMv_7rsQzaXswDIgEqDVZy9VX8dcZxO9x53eV9Jitgvsnk8LTUDLfU3o2JcUbJfSVI7s&sai=AMfl-YTYj8nR55FZ9-rWtE-uel5guuEnRujFAaZYAsR8pzvsf5C9mkWABMahc8QHtpVikiED6NEIE1vegi3qfRrFYy5QX1j_7BrCYa5-y23_GhhFzI33dGBPqRlbYuCLxjgB2gxm1s5HnLk1ym6y&sig=Cg0ArKJSzHw6zDk8eS65EAE&cid=CAQSSwDICaaNOgYlrYT-1p5fnyWi-Y2bpPNFOeLFqjObFrsmIF02N7CxcsNKH0_BVjhCHujJVtYbfBoicdDifH4StJDYp2C0lytfiPF_DBgB&id=lidar2&mcvt=1132&p=0,0,200,200&mtos=1132,1132,1132,1132,1132&tos=1132,0,0,0,0&v=20231030&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2298390012&rs=2&la=0&cr=0&vs=4&r=v&rst=1698856807554&rpt=793&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/ Frame 3F8E 9 KB
4 KB 26ms
25ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e584410e52ac7818fbfdaae948cb42a3355eb1b6335bc0bbfd20186331a58d74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://welovesa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59054
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4100
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 00:15:55 GMT
etag: 15134155877240692467
expires: Wed, 15 Nov 2023 00:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/ Frame E702 9 KB
4 KB 30ms
29ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e584410e52ac7818fbfdaae948cb42a3355eb1b6335bc0bbfd20186331a58d74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://welovesa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59054
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4100
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 00:15:55 GMT
etag: 15134155877240692467
expires: Wed, 15 Nov 2023 00:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/ Frame 7AC1 9 KB
4 KB 28ms
25ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e584410e52ac7818fbfdaae948cb42a3355eb1b6335bc0bbfd20186331a58d74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://welovesa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59054
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4100
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 00:15:55 GMT
etag: 15134155877240692467
expires: Wed, 15 Nov 2023 00:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/ Frame C747 9 KB
4 KB 27ms
26ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e584410e52ac7818fbfdaae948cb42a3355eb1b6335bc0bbfd20186331a58d74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://welovesa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59054
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4100
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 00:15:55 GMT
etag: 15134155877240692467
expires: Wed, 15 Nov 2023 00:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 9751 16 B
209 B 74ms
66ms Fetch
application/json 18.135.134.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.135.134.29 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 106ms
28ms Preflight 18.135.134.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.135.134.29 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-135-134-29.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Wed, 01 Nov 2023 16:40:09 GMT
server: nginx

GET
H3 200 css2
fonts.googleapis.com/ Frame 3F8E 4 KB
671 B 27ms
27ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 01 Nov 2023 16:40:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 01 Nov 2023 15:06:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Nov 2023 16:40:09 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 3F8E 205 B
651 B 76ms
14ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 02:28:25 GMT
x-content-type-options: nosniff
age: 483104
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 26 Oct 2024 02:28:25 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 3F8E 604 B
696 B 77ms
15ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 11:17:16 GMT
x-content-type-options: nosniff
age: 537773
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 25 Oct 2024 11:17:16 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/ Frame 3F8E 15 KB
7 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea1bccd5bd591ef9692b2d24f3f10b79483b891fd217cd4e7d115e33c1fce4d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:42:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75476
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6641
x-xss-protection: 0
server: cafe
etag: 2088779584902205610
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:42:13 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/ Frame 3F8E 20 KB
8 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5198b4b9434e8096a62ef0b08309a7835e40508875b5cb3f2daa929fe28757ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:42:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75476
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8600
x-xss-protection: 0
server: cafe
etag: 14061149270319446037
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:42:13 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C3E0 624 B
245 B 70ms
65ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwNPDmAEwAQ&v=APEucNXZ2jfXVWU0W5FHgTB3HYVNJGHetvEjAyA34OAGwoElcYMcXFkM72BdwrOunxQbStT4eST038e76vPZLfGvb5_E9GoI6z_jskU0Q0eTPMhlOaojxKpHQ4Qcpmersw1P-sOqqp4hCnIjF2UIMM3j4gznPjWftWiQHgwXxpZ6M-8GW2EWDz0

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:40:09 GMT
expires: Wed, 01 Nov 2023 16:40:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame B3EA 111 KB
39 KB 88ms
14ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 02:22:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51467
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 02 Nov 2023 02:22:22 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/ Frame B3EA 7 KB
3 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:28:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76310
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:28:19 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/ Frame B3EA 23 KB
9 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/abg_lite_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08979ac5dc183c913f0f274b03a248982b04fea0aac48c10ae1bd0b717f42641

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:20:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76775
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9142
x-xss-protection: 0
server: cafe
etag: 3118617226516770384
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:20:34 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame B3EA 41 KB
14 KB 20ms
18ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 14:17:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440530
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 14:17:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/ Frame B3EA 3 KB
1 KB 26ms
13ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/window_focus_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 15:26:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4426
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Nov 2023 15:26:23 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/ Frame B3EA 20 KB
8 KB 27ms
14ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5ba431addebca895832667d33e2ad51e4da1a1f2fbab72116d716c08077695a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:18:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76875
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8430
x-xss-protection: 0
server: cafe
etag: 7000445677337367579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:18:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B3EA 188 KB
59 KB 75ms
54ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfd86eed5b662601ed1effa05e0922030a1bbfb3111d160df9b4f71630198c37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60393
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698666127188353"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Nov 2023 16:40:09 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B3EA 42 B
63 B 55ms
48ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BzptbCRR9tVSQjMUJFk_PSnX2-e3ASvlox2m_jR_ruc3UtOw69WWhSjzuMlgBXdkF6T0IRvbNAA4WT8E2TiJPRUyqwyCsAkVigqMW_OwtiI_QmBwg

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 15E4 624 B
245 B 70ms
69ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwNPDmAEwAQ&v=APEucNXZ6ut6nWy33xGK2jB0palErA3unn8-cD2DXwzyapO4MoQBxn07P6R9l12srtUqIS2AWClqBTWH4XEntco7jpOHnW4HP1cx6F3bHR09GoOGCDnfkD-eiLgFgTYb7t-0RjvjJv1JQfuf29HKmAC_MhsUOnVC1F5agzGx7znJMgNTBAxh2TY

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:40:09 GMT
expires: Wed, 01 Nov 2023 16:40:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 89EA 111 KB
39 KB 61ms
33ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 02:22:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51467
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 02 Nov 2023 02:22:22 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/ Frame 89EA 7 KB
3 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:28:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76310
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:28:19 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/ Frame 89EA 23 KB
9 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/abg_lite_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08979ac5dc183c913f0f274b03a248982b04fea0aac48c10ae1bd0b717f42641

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:20:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76775
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9142
x-xss-protection: 0
server: cafe
etag: 3118617226516770384
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:20:34 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 89EA 41 KB
14 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 14:17:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440530
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 14:17:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/ Frame 89EA 3 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/window_focus_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 15:26:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4426
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Nov 2023 15:26:23 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/ Frame 89EA 20 KB
8 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5ba431addebca895832667d33e2ad51e4da1a1f2fbab72116d716c08077695a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:18:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76875
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8430
x-xss-protection: 0
server: cafe
etag: 7000445677337367579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:18:54 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 89EA 188 KB
59 KB 81ms
80ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfd86eed5b662601ed1effa05e0922030a1bbfb3111d160df9b4f71630198c37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60393
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698666127188353"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Nov 2023 16:40:09 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 89EA 42 B
63 B 55ms
51ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DJxkTTtVPwux7PbClR8xD7KRUeT0V7ryl5ESR8pVLDvOhd-OT-3RmX-9IK3SW98fqdR4o8n89qKz1vYblzKn4E8BrKQAHuseyPfUSYJZezMoE_vJc

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8328 640 B
262 B 68ms
66ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhClv9XzARjy8576ATAB&v=APEucNUR-qTy1sp97hR3EORfCLi5wP1KFNJqK08TG3L1BWwaihCD-Nxt9FynqdKubUVX2Q2gNdIfmzbsjMh6jlPYRPli19SphWndD68CQzsThNDGxO6zgYCk19RbBmoHICyousFm6UoMh76TN4e3EqCQtELPLamQcvwx-lsH7xNRGFnuCOCrYtc

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:40:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/ Frame 8CFA 23 KB
9 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/abg_lite_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08979ac5dc183c913f0f274b03a248982b04fea0aac48c10ae1bd0b717f42641

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:20:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76775
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9142
x-xss-protection: 0
server: cafe
etag: 3118617226516770384
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:20:34 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/ Frame 8CFA 7 KB
3 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231026/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:28:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76310
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:28:19 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CFA 0
0 143ms
59ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstWTDqOU7N4eKEaETUrIx9EFwE1oO-glUQpiP8kDjcEzyxKYQ1XI2zGb0Ds5j5xnLt9wUficGbG4LnQy_nlo9w5YIMETx0IP2s4owc9xrMakguCkgkqPnC4P_xuaq0T2YKMQM8PdchwJ-4i9wW_hG7N7y9JD-SuIi_K7b6neB9mTgmmT8-1FsKwEkGbCuSn1RhZKp-NTrHqWmCO-sPuzTGsPZViY4l6-AyO9FHQlogU8o_qYt6cMuWQaIWpWks-42ZAO54bHjKx0pZRrxdjB1TcM6ujW1nV55FxQyN4jenhTRGIeLPnSCGEWXmCphzDVwv7DTYEJqrC35-OUeW3ZHZspkKJhHcLBfH6HRRCCzFN_laMIX9mqov8qfCpVh6to88Rl52LCfgGrvdNSafAeQU_X2LVgJtllwoNhRxDXOu9nbOMOBj0F9F7IyVVUcDBKdeK2OVkqyVpKd_s1rCOHEFog7IhQlkEqUpCoLnp7LrDLR7gxbsadxJyts7C7kDHGwFR2Ru8fUW9NIW_qJx5_HVpReeLe-TWaJO-PmBwj04Ag9bHnij2EBYYIlx1-e3jQJm0OTQXge8PWjODw51RG_qW2eRDKjCImj5mpvaCHSdlM9L86UC0vCeCVKtK8ZWlYPORZC7vi0fF8N8VKQQTw7MOEJ8kE-yKwiVAMtUWSzNOWClkRMGKYIPEDNgf_ZhphTVj8-ssZy5K6uSkrBe94xx0dSTWNhZP0sJJRc1JO6KQmm6ct_FuYdHhaqHBQqDiUkEbamvzgkDK28-31bsC4f18--nhYNOmIPL3RtFyBfGBepn5imWS3VjUluYzidg3esPImKOyfMadT1EFlnR4oY1ysU80JvCsQ55ClA7PuvkDvldcAy5C3qN2eNJw6zoEcamlKux0NR_SpOoYAyAJDCdNCENA1d712LdZ6UVOXgzZJbPB3JvzQyqwJ4Iy09HuwHRmDDSnOH9udPNjhP4hqDJBQoJX1s-2Jptahbolv-PmJ_e81WWMDUP8_lLL4kM1O-1rJPTmTpuaaBHncVSc17yMuZ-NPdL7W3lSj_VpwjccdhcgHnWuLtWJfNSS1bRAis5BhyFjmHdp0ZqsmyWkzzAqTbXG7iEz43Z1PPfkUAP6KQDi7HIH7rfGXC_KNpvY0TJyUkYQfl1WVFPCvn402bttO30iDRwABKJMlaB58KfYtAXSeAdeFgGbmfNyCOz4i2fl8CiPX5oKf1KvrWgVxp8H&sai=AMfl-YSKT60r4VKtR0el8jDU6DII3SecKADmSQKUqAKAdC22YlW20_kDMs_o-2UYunHdk-5k_DsqjNtd7JlMoKi4P3zWlNTkSZDmYduOBswjL47DZp7TvE7A2PKTXWxfZQ901kDHmzspW6RWr_efDMvgFb0d2yNRTkLbjgB-rofzB5iXCchxLZYEiv9R1OFXHtRs8C6_QGBzN-nurnMR5WU4Mr0VtlGpFw795PjPm1f5yHbzg1dFjMmA9BcDhRQ2-gFx9ti1mGGH3WYeaa6w4waLe_K_h3wprh3-Br6O0KSTkhVaPATX8oa7dhfEkbi5yxlE_3QtTi88PUzsO_NCsheRKK4zQI1gaCj2MlXmmYReQhBjiHrq2BM03i2k68fRLgSZvdHWg-qAx3gwGMI1nyFp-M6EAYOi4mQZL5tqx8u8r44r7ixtNmGDPd6LNY8eVZ_8X1KXbuFMpGTbJhKR7FmBw_ac2lXj0zLv4ZYkztxh&sig=Cg0ArKJSzCjkYEg9I0a_EAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20231026.05192&arae=0&ftch=1&adurl=

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 8CFA 41 KB
14 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Fri, 27 Oct 2023 14:17:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 440530
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 26 Oct 2024 14:17:59 GMT

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/rjss/st/1686316/75378124/ Frame 8CFA 46 KB
12 KB 159ms
38ms Script
application/javascript 52.209.54.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/rjss/st/1686316/75378124/skeleton.js
Requested by: Host: welovesa.com
URL: http://welovesa.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.54.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-54-18.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e450dda9deb0a750378758d583dbdcb01c3f369fa98f9919d0a48be1784c0030

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2

200

1x1.gif
imagesrv.adition.com/ Frame 8CFA
Redirect Chain

https://ad3.adfarm1.adition.com/banner?sid=3622302&gdpr=&gdpr_consent=&kid=6122943&bid=18514757&wpt=C&ts=[timestamp]
https://imagesrv.adition.com/1x1.gif

68 B
178 B

63ms
13ms

Image
image/gif

217.79.188.10
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/1x1.gif
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Protocol: H2
Server: 217.79.188.10 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 5fb3bdb7f966c852579fb6b0574517445d5b2d171c804d66227ee67b1bffca9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 01 Nov 2023 16:40:09 GMT
last-modified: Fri, 24 Jul 2009 13:46:10 GMT
accept-ranges: bytes
etag: "3122740758"
content-length: 68
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 17:40:09 +0100
server: ADITIONSERVER v1.0
etag: 7296534435279537369
content-type: text/plain
location: https://imagesrv.adition.com/1x1.gif
access-control-allow-origin: *
p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
cache-control: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/ Frame 8CFA 3 KB
1 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/window_focus_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 15:26:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4426
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Nov 2023 15:26:23 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/ Frame 8CFA 20 KB
8 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5ba431addebca895832667d33e2ad51e4da1a1f2fbab72116d716c08077695a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:18:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76875
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8430
x-xss-protection: 0
server: cafe
etag: 7000445677337367579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:18:54 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8CFA 188 KB
59 KB 87ms
86ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfd86eed5b662601ed1effa05e0922030a1bbfb3111d160df9b4f71630198c37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60393
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698666127188353"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Nov 2023 16:40:09 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CFA 42 B
63 B 52ms
49ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D5R_Q3d5degDkr5rc9to83-IQlKjHRvW6p3DtGJe-j-qFp6Yrg3Tc1yMe5HCG9jqKUh2IGADtOgT4dOltw9jVAMlL2ljZkTnPQyZcrE-8rAJwXyAg

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

B30605926.377194417;dc_pre=CPawt-Weo4IDFarVEQgdPQ4FRw;dc_trk_aid=568064973;dc_trk_cid=200047240;ord=[timestamp];dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_...
ad.doubleclick.net/ddm/trackimp/N4362.2566103PREXPROGRAMMATICEXC/ Frame 8CFA
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N4362.2566103PREXPROGRAMMATICEXC/B30605926.377194417;dc_trk_aid=568064973;dc_trk_cid=200047240;ord=[timestamp];dc_lat=;dc_rdid=;tag_for_child_directed_treatm...
https://ad.doubleclick.net/ddm/trackimp/N4362.2566103PREXPROGRAMMATICEXC/B30605926.377194417;dc_pre=CPawt-Weo4IDFarVEQgdPQ4FRw;dc_trk_aid=568064973;dc_trk_cid=200047240;ord=[timestamp];dc_lat=;dc_r...

42 B
118 B

43ms
37ms

Image
image/gif

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N4362.2566103PREXPROGRAMMATICEXC/B30605926.377194417;dc_pre=CPawt-Weo4IDFarVEQgdPQ4FRw;dc_trk_aid=568064973;dc_trk_cid=200047240;ord=[timestamp];dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1?

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N4362.2566103PREXPROGRAMMATICEXC/B30605926.377194417;dc_pre=CPawt-Weo4IDFarVEQgdPQ4FRw;dc_trk_aid=568064973;dc_trk_cid=200047240;ord=[timestamp];dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 11248201431227359308
s0.2mdn.net/simgad/ Frame 8CFA 60 KB
60 KB 66ms
14ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/11248201431227359308

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

506bafc5e19fdba479d912204ef60ce4c94595238b59e7fc89091b94c1acf3c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 23:01:49 GMT
x-content-type-options: nosniff
age: 63500
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61557
x-xss-protection: 0
last-modified: Wed, 11 Oct 2023 09:27:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 30 Oct 2024 23:01:49 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A897 0
20 B 49ms
47ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1729264751273&version=m202309260101&ct=77&x=1&cor=7073400321747031000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C3E0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1

43 B
732 B

32ms
26ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwNPDmAEwAQ&v=APEucNXZ2jfXVWU0W5FHgTB3HYVNJGHetvEjAyA34OAGwoElcYMcXFkM72BdwrOunxQbStT4eST038e76vPZLfGvb5_E9GoI6z_jskU0Q0eTPMhlOaojxKpHQ4Qcpmersw1P-sOqqp4hCnIjF2UIMM3j4gznPjWftWiQHgwXxpZ6M-8GW2EWDz0
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3SpM7aDG2MySeWsTVyCfpTe%2B1UWWAtZ67L5PzOFoqULr6dhqne65QwZxTedDm4YJpf2pc3%2Fku2FmhoFsyaOfDPa304ZvCyrsKD5zsufrsej%2ByzCl65I4S0LuYIVClNW3t%2BKRgApxbbQzAg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81f593f61bfd4d84-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C3E0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUJ-Z8O02mdLAyysl.N6DQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1&google_hm=2

43 B
737 B

46ms
42ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwNPDmAEwAQ&v=APEucNXZ2jfXVWU0W5FHgTB3HYVNJGHetvEjAyA34OAGwoElcYMcXFkM72BdwrOunxQbStT4eST038e76vPZLfGvb5_E9GoI6z_jskU0Q0eTPMhlOaojxKpHQ4Qcpmersw1P-sOqqp4hCnIjF2UIMM3j4gznPjWftWiQHgwXxpZ6M-8GW2EWDz0
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xW%2BsPv5qzYJI87g4iJFXgotIqfECf6mEyK%2FqIFIyndJrRZpqQhQ7QrfNAGIvca33koQfl3XwiJH2%2FpOrJVud%2BOuPqe%2FnDrtuKeJ8GRGMznewh7w2VPNLS%2BkXGVH9ukNH7bNaiwP3jzxAuw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81f593f66c694d84-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame C3E0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHPecszO1Xh4HrFOMAF-5Zc&google_cver=1

43 B
848 B

21ms
15ms

Image
image/gif

185.89.210.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHPecszO1Xh4HrFOMAF-5Zc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwNPDmAEwAQ&v=APEucNXZ2jfXVWU0W5FHgTB3HYVNJGHetvEjAyA34OAGwoElcYMcXFkM72BdwrOunxQbStT4eST038e76vPZLfGvb5_E9GoI6z_jskU0Q0eTPMhlOaojxKpHQ4Qcpmersw1P-sOqqp4hCnIjF2UIMM3j4gznPjWftWiQHgwXxpZ6M-8GW2EWDz0

Protocol

Server

185.89.210.244 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
an-x-request-uuid: 43270c85-4572-4ab1-ba8b-442821170eac
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.139; 178.162.209.139; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHPecszO1Xh4HrFOMAF-5Zc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3E0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNDA0OTk3MjI4NzY4MDIyNw%3D%3D

170 B
188 B

47ms
45ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNDA0OTk3MjI4NzY4MDIyNw%3D%3D

Requested by

Protocol

Server

142.250.74.194 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
an-x-request-uuid: d010412b-c812-442f-9841-a0092addca90
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNDA0OTk3MjI4NzY4MDIyNw%3D%3D
x-proxy-origin: 178.162.209.139; 178.162.209.139; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9751 0
20 B 49ms
48ms Ping
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8607079609166&version=m202309260101&ct=77&x=1&cor=9300594981998146000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 15E4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1

43 B
733 B

51ms
50ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwNPDmAEwAQ&v=APEucNXZ6ut6nWy33xGK2jB0palErA3unn8-cD2DXwzyapO4MoQBxn07P6R9l12srtUqIS2AWClqBTWH4XEntco7jpOHnW4HP1cx6F3bHR09GoOGCDnfkD-eiLgFgTYb7t-0RjvjJv1JQfuf29HKmAC_MhsUOnVC1F5agzGx7znJMgNTBAxh2TY
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hpQV1QEUneVMEhSlbiQ96JcvoZv4Yj1Nq1zXBkg0VEk4xDG8oxU6rU6qd3KCA44GX8CgqWFNIUlSAsIX%2BDPivE0I%2BQQOYhCxBRtD3ptYHyxfzels%2BSkgDu9A3MK9EBWaJujWFtoPIivWPg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81f593f66c614d84-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 15E4
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZUJ-Z8O02mdLAyysl.N6DQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1&google_hm=2

43 B
729 B

41ms
40ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwNPDmAEwAQ&v=APEucNXZ6ut6nWy33xGK2jB0palErA3unn8-cD2DXwzyapO4MoQBxn07P6R9l12srtUqIS2AWClqBTWH4XEntco7jpOHnW4HP1cx6F3bHR09GoOGCDnfkD-eiLgFgTYb7t-0RjvjJv1JQfuf29HKmAC_MhsUOnVC1F5agzGx7znJMgNTBAxh2TY
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=92FoQoAridepiAZsM7XYJmblqa2oLltbwD66x0JatatcunIwNXuPeK1rxPrFoTpVUF7kvUJQahQ4CE7i6RlFgx5mrShUMo2vQtH0TwQ30pusfppL3tHgqQ%2B%2FkxkPGYbXhcON79D31joN%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81f593f6bcbc4d84-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHlazvP8xYpiVLOP-Az04Zs&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 15E4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHPecszO1Xh4HrFOMAF-5Zc&google_cver=1

43 B
849 B

22ms
22ms

Image
image/gif

185.89.210.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHPecszO1Xh4HrFOMAF-5Zc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYwNPDmAEwAQ&v=APEucNXZ6ut6nWy33xGK2jB0palErA3unn8-cD2DXwzyapO4MoQBxn07P6R9l12srtUqIS2AWClqBTWH4XEntco7jpOHnW4HP1cx6F3bHR09GoOGCDnfkD-eiLgFgTYb7t-0RjvjJv1JQfuf29HKmAC_MhsUOnVC1F5agzGx7znJMgNTBAxh2TY

Protocol

Server

185.89.210.244 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
an-x-request-uuid: 08164f8f-3ced-4765-a947-c5e2c684f6c5
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.139; 178.162.209.139; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHPecszO1Xh4HrFOMAF-5Zc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 15E4
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNDA0OTk3MjI4NzY4MDIyNw%3D%3D

170 B
188 B

24ms
24ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNDA0OTk3MjI4NzY4MDIyNw%3D%3D

Requested by

Protocol

Server

142.250.74.194 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
an-x-request-uuid: 9a84b505-a149-4c2b-840b-b05be2e513c9
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNDA0OTk3MjI4NzY4MDIyNw%3D%3D
x-proxy-origin: 178.162.209.139; 178.162.209.139; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 8328
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELTbCbwxqOAtAOYmrQWOA_E&google_cver=1

43 B
114 B

698ms
684ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELTbCbwxqOAtAOYmrQWOA_E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhClv9XzARjy8576ATAB&v=APEucNUR-qTy1sp97hR3EORfCLi5wP1KFNJqK08TG3L1BWwaihCD-Nxt9FynqdKubUVX2Q2gNdIfmzbsjMh6jlPYRPli19SphWndD68CQzsThNDGxO6zgYCk19RbBmoHICyousFm6UoMh76TN4e3EqCQtELPLamQcvwx-lsH7xNRGFnuCOCrYtc
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELTbCbwxqOAtAOYmrQWOA_E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 8328 43 B
304 B 84ms
28ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhClv9XzARjy8576ATAB&v=APEucNUR-qTy1sp97hR3EORfCLi5wP1KFNJqK08TG3L1BWwaihCD-Nxt9FynqdKubUVX2Q2gNdIfmzbsjMh6jlPYRPli19SphWndD68CQzsThNDGxO6zgYCk19RbBmoHICyousFm6UoMh76TN4e3EqCQtELPLamQcvwx-lsH7xNRGFnuCOCrYtc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 8328
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESELERGCYg_dbTsso4jPUFWO4&google_cver=1

23 B
163 B

89ms
37ms

Image
image/gif

23.218.209.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESELERGCYg_dbTsso4jPUFWO4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhClv9XzARjy8576ATAB&v=APEucNUR-qTy1sp97hR3EORfCLi5wP1KFNJqK08TG3L1BWwaihCD-Nxt9FynqdKubUVX2Q2gNdIfmzbsjMh6jlPYRPli19SphWndD68CQzsThNDGxO6zgYCk19RbBmoHICyousFm6UoMh76TN4e3EqCQtELPLamQcvwx-lsH7xNRGFnuCOCrYtc
Protocol: H2
Server: 23.218.209.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-209-56.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

expires: Wed, 01 Nov 2023 16:40:10 GMT
pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESELERGCYg_dbTsso4jPUFWO4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 8328 23 B
163 B 102ms
35ms Image
image/gif 23.218.209.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhClv9XzARjy8576ATAB&v=APEucNUR-qTy1sp97hR3EORfCLi5wP1KFNJqK08TG3L1BWwaihCD-Nxt9FynqdKubUVX2Q2gNdIfmzbsjMh6jlPYRPli19SphWndD68CQzsThNDGxO6zgYCk19RbBmoHICyousFm6UoMh76TN4e3EqCQtELPLamQcvwx-lsH7xNRGFnuCOCrYtc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.218.209.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-209-56.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

expires: Wed, 01 Nov 2023 16:40:10 GMT
pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3 200 css
fonts.googleapis.com/ Frame F3A3 14 KB
1 KB 24ms
24ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 01 Nov 2023 16:40:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 01 Nov 2023 14:58:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Nov 2023 16:40:09 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/ Frame F3A3 2 KB
825 B 14ms
13ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d66ca23a7be1d8803307f937a250d0f90959f1289862b8e870d6795000f2b731

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:19:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76850
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 798
x-xss-protection: 0
server: cafe
etag: 15713038447858168282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:19:19 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/ Frame F3A3 23 KB
9 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08979ac5dc183c913f0f274b03a248982b04fea0aac48c10ae1bd0b717f42641

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:18:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76888
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9142
x-xss-protection: 0
server: cafe
etag: 3118617226516770384
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:18:41 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9D9A 143 B
166 B 27ms
24ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 971
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:23:58 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/ Frame F3A3 3 KB
1 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 15:26:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4426
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Nov 2023 15:26:23 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/ Frame F3A3 20 KB
8 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231026/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5ba431addebca895832667d33e2ad51e4da1a1f2fbab72116d716c08077695a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 31 Oct 2023 19:18:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76875
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8430
x-xss-protection: 0
server: cafe
etag: 7000445677337367579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 19:18:54 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F3A3 188 KB
59 KB 72ms
70ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfd86eed5b662601ed1effa05e0922030a1bbfb3111d160df9b4f71630198c37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60393
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698666127188353"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Nov 2023 16:40:10 GMT

GET
H2 200 ac1dbca482530a26bafc7a8c1241173a.js Show response
www.gstatic.com/mysidia/ Frame F3A3 36 KB
15 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ac1dbca482530a26bafc7a8c1241173a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cddb42bd69440699ae8fe758dac4d5f52911fa67b2a7a637d5d1bcfa2d88b0d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 07:11:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34107
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15099
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 19:42:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 30 Jan 2024 07:11:42 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7306017839684792401/ Frame 6163 28 KB
5 KB 25ms
24ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84fff6fd85bd09ee42d72005735900ff8c6e819a22d21a2165303e9c995a1eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 551812
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5528
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 07:23:18 GMT
expires: Fri, 25 Oct 2024 07:23:18 GMT
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame B3EA 0
0 70ms
68ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsus7Oi2RvRfgFrhcwV0TaDeDkVPki3Us40zFgQgKdx_dq8fsUaywjIKryxrfOFc9UCot9qTCi3qUw5X5Mf_Y6Er8Mx8bSvhZb4JQThKGCByODg439dgzcgqF95eRVLfEfq1jR5Ap2rfr7UvAHypDvkMTnRbrBG9woG5otwIsMMorreDVIGJLk1-sh08HOe4-zHZZa7h0LPH7wflo6f6k5wbnZy50e9aEfGbRucnMxjBUXO_khRaCdGL2WG37R_jvf8APuGgAohBGy3rEJSF0Xht3XjvESuFMzQDl_hMq-JNdS0ZCso1Tx_s1-Rfpy9HFjfE4zIzHMV6AEOx1Oesp0Y3kMiTiPBhDhm3BlfRVSm4VUWaT_frnfcRqjN1ZLj-y1_khV1w1hmanVQOsR8fzELPmLvIhPmsRLalv4hCKdMPPCKSuSweCv-SCTd5MHUmbrSJHqy2Ej1toTYnMZX2AsDdSHXaZJqu-odQCFTj54OTKYBFrwZC5WAPQjkshoGhw_Z1ODXEDDJRLcaq0k4P1PhMy-bi-sZRdmNlZTQSLeMUB3Dw9GAiBjsFY06dVo9cnrdOWf2OmrmzRMPmNG1y1_WWiIZ4gnvuMlcbEP_3l9hxPYtnteLlmE_JVIOjNK83FzR4hdb0qbzEWD38_QVrYsutkn6Mn1QDDm2C4jWPadjC175C8bdcTPRZre_R72RrJKjsCC8yqtS_g3GW6ddVXTk93_fJGcC2-ioQdtdEHgyuO2l22pQ9UegVM-NDL2m9At6DU_lrqHQ_qNQKeca8-dYEdgyCD7DGnygFutupIfqWsn-dd7LBEwBsYRWIl6S3EWQm15GV1LHf3w84mpCOhZmInrY6mtdHjL248fqJUh1FQ5CBhYebFfjvpK1sAxNTRrQeId0wJi1nxUfZKtAgIJtc2o6KSgbIqciGpOptF4tlrllAuSXLp5YBZY2zQcEny0DGEzRMgkP1VXwOdKnuOogWZw_vRo_GacDxm-S8OvIZhRMzJF4VzinBeTYeHKTdm9PGfmDTe64PMH2fCTL3I0CjgiIuhuwGchj-WDwQxZSd6WOqqKucDDuUshqMib-QS_SymKIiiAWSm-5aLpjnZKH3XA5Kt6lD7hbIKnGISoXSld3iZ1Rqu9zxJkKl98QGvrKK31KkxwHfbp0kseCljdMq1NbJYK570NvNmshDzKB4aqERkmiUQ4w&sai=AMfl-YTIOVHV_HT_7yAZeGktQtF9ZoqU_lTia_vLnGK-zB66SUQIr_erOYiLDXvpo_sDu1WXTA0r1WuHseVq0gNF05_nHtBkBOCi48Bwpz4hnXGPUD7TGnYquUOtdQhS7CvCnQfHzCEAj-cUoaGliMyWnE7VaNh-7y_wQBhtDdNq5R8g08V_PHjIT3BNiUrEpCAfJvjD4Uz85UzZDepdwA9HwhuqU9bRl4FK7ipFiT_4ayMUVCf19gXjeCosY6xKtpIMlGLOBSQ2u8OMkE1p7hRa0HwF1cB3Cp8JMiOLxl4Zu7ZxtFHpLWQ2Axs82d9tjmh6iJ23WfQa5Jx6o7tMDlQzyprfKX2WGoi8z9psh7j3cL-zTBm0CrnH84AmF4gHqTYP7etqIbpDN7QEd_bkcD8DIXjv8eb48qzWk3pwAY0yi2aUMESjvjuAdaMDuBDtebgup0o6ql_NwZp4gWYVHDZzwXKsNlQxsb6JhyBSy-Yu&sig=Cg0ArKJSzBfHsqwm2pBhEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=324&cbvp=1&cstd=319&cisv=r20231026.97952&arae=0&ftch=1&adurl=

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 01 Nov 2023 16:40:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CFA 0
0 59ms
58ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstWTDqOU7N4eKEaETUrIx9EFwE1oO-glUQpiP8kDjcEzyxKYQ1XI2zGb0Ds5j5xnLt9wUficGbG4LnQy_nlo9w5YIMETx0IP2s4owc9xrMakguCkgkqPnC4P_xuaq0T2YKMQM8PdchwJ-4i9wW_hG7N7y9JD-SuIi_K7b6neB9mTgmmT8-1FsKwEkGbCuSn1RhZKp-NTrHqWmCO-sPuzTGsPZViY4l6-AyO9FHQlogU8o_qYt6cMuWQaIWpWks-42ZAO54bHjKx0pZRrxdjB1TcM6ujW1nV55FxQyN4jenhTRGIeLPnSCGEWXmCphzDVwv7DTYEJqrC35-OUeW3ZHZspkKJhHcLBfH6HRRCCzFN_laMIX9mqov8qfCpVh6to88Rl52LCfgGrvdNSafAeQU_X2LVgJtllwoNhRxDXOu9nbOMOBj0F9F7IyVVUcDBKdeK2OVkqyVpKd_s1rCOHEFog7IhQlkEqUpCoLnp7LrDLR7gxbsadxJyts7C7kDHGwFR2Ru8fUW9NIW_qJx5_HVpReeLe-TWaJO-PmBwj04Ag9bHnij2EBYYIlx1-e3jQJm0OTQXge8PWjODw51RG_qW2eRDKjCImj5mpvaCHSdlM9L86UC0vCeCVKtK8ZWlYPORZC7vi0fF8N8VKQQTw7MOEJ8kE-yKwiVAMtUWSzNOWClkRMGKYIPEDNgf_ZhphTVj8-ssZy5K6uSkrBe94xx0dSTWNhZP0sJJRc1JO6KQmm6ct_FuYdHhaqHBQqDiUkEbamvzgkDK28-31bsC4f18--nhYNOmIPL3RtFyBfGBepn5imWS3VjUluYzidg3esPImKOyfMadT1EFlnR4oY1ysU80JvCsQ55ClA7PuvkDvldcAy5C3qN2eNJw6zoEcamlKux0NR_SpOoYAyAJDCdNCENA1d712LdZ6UVOXgzZJbPB3JvzQyqwJ4Iy09HuwHRmDDSnOH9udPNjhP4hqDJBQoJX1s-2Jptahbolv-PmJ_e81WWMDUP8_lLL4kM1O-1rJPTmTpuaaBHncVSc17yMuZ-NPdL7W3lSj_VpwjccdhcgHnWuLtWJfNSS1bRAis5BhyFjmHdp0ZqsmyWkzzAqTbXG7iEz43Z1PPfkUAP6KQDi7HIH7rfGXC_KNpvY0TJyUkYQfl1WVFPCvn402bttO30iDRwABKJMlaB58KfYtAXSeAdeFgGbmfNyCOz4i2fl8CiPX5oKf1KvrWgVxp8H&sai=AMfl-YSKT60r4VKtR0el8jDU6DII3SecKADmSQKUqAKAdC22YlW20_kDMs_o-2UYunHdk-5k_DsqjNtd7JlMoKi4P3zWlNTkSZDmYduOBswjL47DZp7TvE7A2PKTXWxfZQ901kDHmzspW6RWr_efDMvgFb0d2yNRTkLbjgB-rofzB5iXCchxLZYEiv9R1OFXHtRs8C6_QGBzN-nurnMR5WU4Mr0VtlGpFw795PjPm1f5yHbzg1dFjMmA9BcDhRQ2-gFx9ti1mGGH3WYeaa6w4waLe_K_h3wprh3-Br6O0KSTkhVaPATX8oa7dhfEkbi5yxlE_3QtTi88PUzsO_NCsheRKK4zQI1gaCj2MlXmmYReQhBjiHrq2BM03i2k68fRLgSZvdHWg-qAx3gwGMI1nyFp-M6EAYOi4mQZL5tqx8u8r44r7ixtNmGDPd6LNY8eVZ_8X1KXbuFMpGTbJhKR7FmBw_ac2lXj0zLv4ZYkztxh&sig=Cg0ArKJSzCjkYEg9I0a_EAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=233&vt=11&dtpt=231&dett=2&cstd=0&cisv=r20231026.05192&arae=0&ftch=1&adurl=

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7306017839684792401/ Frame 448B 28 KB
5 KB 17ms
16ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84fff6fd85bd09ee42d72005735900ff8c6e819a22d21a2165303e9c995a1eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 551812
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5528
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 07:23:18 GMT
expires: Fri, 25 Oct 2024 07:23:18 GMT
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 89EA 0
0 61ms
60ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuP4WoLH5SXs9zQdsZdcu6eRSZHQH5rolYTVGQYS8BxLNQl8z_LjSlwgKeVjpMUY1C0pJRM-NToKdQRDV3AqURMw2NewhbE2hNaeM8U-X0zmRCZwlt61Ct64OkJ7rHj6ACtxUkYkwuAtVCnQ2kObFO6mFshUku1YqbEL7VCc2O3CktAZ3RBzDql0MrxoKk1UChz_lVh0SGZXhdgY6SYlPNxNMK56pvxEZeXcFeG6boV4PXM0o2_MRioI8RRPJ7WFpR4J0D9gU2wBrvADVpPC64piNN_plzCatCB_zoaLaTT536dgZTUBnxPFc_x2oy94zkwnNGol00ENB8iwFOtNLNOmzrEGQjvkB13M1uUwTCxctsIiH-V7RXT5LZcgyMibsvA0XpFwsCZ4tDN3_tJPEKY7diV5mli8eFMMNUMr6Rypkk5OfjMGs-EXYckMmVeHpDTibEu0e3Mc0IVmKOSO3A9ICreOcrGjZdz3TXsviuPxxkymkNRfiU01I1Ai2liHSPuzQRBqp79xNP8AB8uy5WdEUry2s6fYvVMuLZTWwAX0PRAffghhEh0slezyfJ9uqhj7Z23x3I_rEfdmnDeehJZBNt1gLI3GRyGDfAJN4VamI3vMB2yuhJRN2UQ7TSvAjY-FYtp7z7If01NlrYHxhi5mH_yKaDFDJ16c1L1Ye8yH8_wtR9aTKTAbYB-5ozJhyTUIojxC8tJU4FGvJ1hGrEXrnzRQQRJ2NnwsXi92yfkpXa-oDCoSiT3ZeUQA4EfkZtEaJ54Nof7a5SAXNt5maCwHTta2ouMZ2wcQ3tLA93QIfzsiDy7AC8z06jD_HOYDPlZKJJGhHe8bp1wYeEEB927306AW_RKCOgP7t1oXyk6YYYyXbKAF4edyljCYw_JzVFdTBbMspXbAVUP9KcXFZ82BKq-76alGpmAJKw7STg-VPBJU5bdLPB93Kt4orgh7Uw2U_Md57ToUp95Q8CtDQOTPqwV10-GA54jdjbvkse5hkpVzcivkIfkom9REFeWbj9imt6myMBwocyVPWPqspTpxKbQHBuPlR6xWOSTCM98jI58deUTEVyJv1ZRsTgvRI2Q2GMgbChJbv1G3H-2ffN02tSwin5EUkH3GLduua02gpk8iXncvRBd4mnDRDFrGXQO_6Msuh7mMPtdI07LbaSkDAB6EkTPcbzgl_gqa61Cl36Feuazqxw&sai=AMfl-YT24Swyvj9fhYVR4AQ-cu12OnBX2ibTdNP0uy0Ypv3guwG7yJ2AtpJsiZ7kr0u6c9LToYDYoKerk3Bd3WaHFgRukhPfOszs8ullWz3f2K_wL1V5QMgI9_hdnjjN-AMEmaatLIAqs2D_F87Fszs7XLUL-HLPzEqqLJSCJf7S01KT54ypNMbm0dmkRBozlX8T5Ji0uBxuomcQ7CsUolbNnVH5MGUvAef-6Q4j6mbT5nqlcARtpSUkkVvafgX070dGEat70hwCWmD_Q3-hhhz2AAH05C9-LIhWmEDqbSpsdvdK0DWJdSrZc5OiTJ69ZfhpQ7Ne9EsPEunbbH2vtYKU5RxfAj6ISydmcyA_xapnHsMfjgy2FTpCLdyZvaF2dHiEOnjeBf554gq31k5Lo4f29H9kF2ufT3HZyX8KpAUHuqDQSIqCQefzAsP3rVXl7MpEX_RJ15I6zGB8vxQQx46beUOoDYWZCB0xdu_ZzPXD&sig=Cg0ArKJSzE99Wn8aeAtjEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=371&cbvp=1&cstd=368&cisv=r20231026.50677&arae=0&ftch=1&adurl=

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 01 Nov 2023 16:40:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F433 38 KB
13 KB 16ms
15ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 440509
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 14:18:21 GMT
expires: Sat, 26 Oct 2024 14:18:21 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 main.19.8.458.js Show response
static.adsafeprotected.com/ Frame 8CFA 210 KB
65 KB 46ms
8ms Script
application/javascript 2600:9000:223f:7400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.458.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/rjss/st/1686316/75378124/skeleton.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:7400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 04f44895e6e1176e6e98a25135be71a57d3e55a33623183114a31a0166a19c04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 20:21:12 GMT
x-amz-version-id: sdzXBL3P.lnLAccw3ZO3IW6gHZS.CO.3
content-encoding: gzip
via: 1.1 91dc0292eef4e22508a3ae73fe64bbf4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 505139
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 26 Oct 2023 16:02:02 GMT
server: AmazonS3
etag: W/"42267cae2551f30d025f7cb1e89c9f73"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 0vzjlPH1j2wOksXSWAlJgzaIg0OdEwR85xMwkzCYZKLkb8ZIBRH1Uw==

GET
DATA 200
OK truncated
/ Frame 8CFA 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5d9f40ba6383fe3d16548f884d537eb4e1214fbd6db9e7498ae7377396463aa1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 0717242f3acd4935e3ae22056ad67479.js Show response
s0.2mdn.net/sadbundle/7306017839684792401/ Frame 6163 132 KB
37 KB 17ms
16ms Script
application/x-javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/0717242f3acd4935e3ae22056ad67479.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a9baaa810bce026c3eebe92d3e06dd30ce107f8acbd02edc127433f03f619d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:09:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 523851
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38353
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 15:09:19 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame DF54 38 KB
13 KB 22ms
21ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 440509
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 14:18:21 GMT
expires: Sat, 26 Oct 2024 14:18:21 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 4A64 38 KB
13 KB 26ms
24ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 440509
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Oct 2023 14:18:21 GMT
expires: Sat, 26 Oct 2024 14:18:21 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 0717242f3acd4935e3ae22056ad67479.js Show response
s0.2mdn.net/sadbundle/7306017839684792401/ Frame 448B 132 KB
37 KB 17ms
15ms Script
application/x-javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/0717242f3acd4935e3ae22056ad67479.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a9baaa810bce026c3eebe92d3e06dd30ce107f8acbd02edc127433f03f619d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:09:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 523851
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38353
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 15:09:19 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9D9A
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

41ms
41ms

Document
text/html

2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:40:10 GMT
expires: Wed, 01 Nov 2023 16:40:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 01 Nov 2023 16:40:10 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js Show response
pagead2.googlesyndication.com/bg/ Frame F433 38 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99235240097ffe1c3ccf93f0275840df66a62f6ce406788402b06df413755d67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 15:45:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3294
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15010
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 31 Oct 2024 15:45:16 GMT

GET
H3 200 9c69f07deadda884c61396a404004929.svg
s0.2mdn.net/sadbundle/7306017839684792401/media/ Frame 6163 1 KB
642 B 16ms
15ms Image
image/svg+xml 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/media/9c69f07deadda884c61396a404004929.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa3efcb1022504df85ff9f59acd76923266eb8a078b3e746457223967d82ba2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 04:30:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 562160
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 613
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 04:30:50 GMT

GET
H3 200 ae1e54839fb207fb04bc9acccfb6869a.png
s0.2mdn.net/sadbundle/7306017839684792401/media/ Frame 6163 16 KB
17 KB 17ms
15ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/media/ae1e54839fb207fb04bc9acccfb6869a.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c08dafbc2cbedae9ace76f4e33693202e157b21ee00978402ff17e29c8bbb8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 14:01:19 GMT
x-content-type-options: nosniff
age: 527931
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16892
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 14:01:19 GMT

GET
H3 200 996bff8e03c5ae38cc1f48a696ba76d7.jpg
s0.2mdn.net/sadbundle/7306017839684792401/media/ Frame 6163 8 KB
8 KB 19ms
17ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/media/996bff8e03c5ae38cc1f48a696ba76d7.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f6cc6aa652b1af4bfcdc571dae17aa096b6b9104feb5101bf79799109861fe5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:09:23 GMT
x-content-type-options: nosniff
age: 523847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8351
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 15:09:23 GMT

GET
H3 200 6d7052ff6df13eae564657f4b45cc79a.svg
s0.2mdn.net/sadbundle/7306017839684792401/media/ Frame 6163 5 KB
3 KB 19ms
18ms Image
image/svg+xml 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/media/6d7052ff6df13eae564657f4b45cc79a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf195ab94cbfaf21aaae06763f8600b9801e4a8423311963e8e913cddc06150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 11:31:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 536898
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2640
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 11:31:52 GMT

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 8CFA
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/1686316/75378124/skeleton.js?adsafe_url=http%3A%2F%2Fwelovesa.com&adsafe_type=g&adsafe_url=http%3A%2F%2Fwelovesa.com%2F&adsafe_type=c&adsafe_url=https%3A%2F...
https://static.adsafeprotected.com/skeleton.js

17 B
464 B

7ms
7ms

Script
application/javascript

2600:9000:223f:7400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Protocol: H2
Server: 2600:9000:223f:7400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Mon, 16 Jan 2023 03:51:51 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 91dc0292eef4e22508a3ae73fe64bbf4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 25015700
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: xb2MHbdVviM8pd5oaRixPSZ35_x-HV43Bi3JlVLD_PIpNpYIkHpedw==

Redirect headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
server: nginx
x-server-name: app21.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 918D 91 KB
23 KB 9ms
8ms Script
application/javascript 2600:9000:223f:7400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:7400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 91dc0292eef4e22508a3ae73fe64bbf4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 3601860
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: fQ80qt8jkh6ov-Hui8G9JP_BlP8qPfYqPSDWBYZtSPzfma3xLzdOPA==

GET
H3 200 mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js Show response
pagead2.googlesyndication.com/bg/ Frame DF54 38 KB
15 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99235240097ffe1c3ccf93f0275840df66a62f6ce406788402b06df413755d67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 15:45:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3294
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15010
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 31 Oct 2024 15:45:16 GMT

GET
H3 200 mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js Show response
pagead2.googlesyndication.com/bg/ Frame 4A64 38 KB
15 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99235240097ffe1c3ccf93f0275840df66a62f6ce406788402b06df413755d67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 15:45:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3294
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15010
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 31 Oct 2024 15:45:16 GMT

GET
H3 200 9c69f07deadda884c61396a404004929.svg
s0.2mdn.net/sadbundle/7306017839684792401/media/ Frame 448B 1 KB
642 B 19ms
18ms Image
image/svg+xml 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/media/9c69f07deadda884c61396a404004929.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/0717242f3acd4935e3ae22056ad67479.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa3efcb1022504df85ff9f59acd76923266eb8a078b3e746457223967d82ba2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 04:30:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 562160
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 613
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 04:30:50 GMT

GET
H3 200 ae1e54839fb207fb04bc9acccfb6869a.png
s0.2mdn.net/sadbundle/7306017839684792401/media/ Frame 448B 16 KB
17 KB 19ms
18ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/media/ae1e54839fb207fb04bc9acccfb6869a.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/0717242f3acd4935e3ae22056ad67479.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c08dafbc2cbedae9ace76f4e33693202e157b21ee00978402ff17e29c8bbb8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 14:01:19 GMT
x-content-type-options: nosniff
age: 527931
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16892
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 14:01:19 GMT

GET
H3 200 996bff8e03c5ae38cc1f48a696ba76d7.jpg
s0.2mdn.net/sadbundle/7306017839684792401/media/ Frame 448B 8 KB
8 KB 20ms
18ms Image
image/jpeg 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/media/996bff8e03c5ae38cc1f48a696ba76d7.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/0717242f3acd4935e3ae22056ad67479.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f6cc6aa652b1af4bfcdc571dae17aa096b6b9104feb5101bf79799109861fe5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:09:23 GMT
x-content-type-options: nosniff
age: 523847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8351
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 15:09:23 GMT

GET
H3 200 6d7052ff6df13eae564657f4b45cc79a.svg
s0.2mdn.net/sadbundle/7306017839684792401/media/ Frame 448B 5 KB
3 KB 20ms
19ms Image
image/svg+xml 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/media/6d7052ff6df13eae564657f4b45cc79a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/0717242f3acd4935e3ae22056ad67479.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf195ab94cbfaf21aaae06763f8600b9801e4a8423311963e8e913cddc06150

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 11:31:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 536898
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2640
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 25 Oct 2024 11:31:52 GMT

GET
H3 200 ibm_plex_sans_500_normal.ttf
s0.2mdn.net/sadbundle/7306017839684792401/fonts/ Frame 6163 173 KB
80 KB 19ms
18ms Font
font/ttf 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/fonts/ibm_plex_sans_500_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11ddde88c29ef7e51f5c03da7fde285085469879139d006f631a62dba9bbd069

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 25 Oct 2023 21:58:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 585677
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81411
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Oct 2024 21:58:53 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CFA 43 B
215 B 326ms
102ms Image
image/gif 2600:1f18:1aca:4280:4bc5:af65:77bc:c3fd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1686316&asId=3338756e-daf0-1900-92f3-c08218c7ae2b&tv=%7Bc:sJQGq4,pingTime:-3,time:328,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:290%7D,%7Bpiv:0,vs:o,r:l,t:327%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,slTimes:%7Bi:0,o:328,n:327,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:290,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B62~1,0~0%5D,as:%5B62~728.90%5D%7D%7D,%7Bsl:o,t:327,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tUns2NG+11%7C1211%7C1212%7C1213%7C1214%7C1215%7C1311%7C1312%7C1313%7C1314%7C1315%7C14%7C1511%7C1611%7C1612%7C1613%7C1711%7C1712%7C1713%7C181*.1686316-75378124%7C1811%7C1812,idMap:181*,rmeas:1,rend:1,renddet:IMG.qs,siq:292%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:4bc5:af65:77bc:c3fd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
server: nginx
x-server-name: dt14.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CFA 43 B
216 B 320ms
100ms Image
image/gif 2600:1f18:1aca:4280:4bc5:af65:77bc:c3fd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1686316&asId=3338756e-daf0-1900-92f3-c08218c7ae2b&tv=%7Bc:sJQGq6,pingTime:-6,time:330,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,slTimes:%7Bi:0,o:330,n:327,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:290,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B62~1,0~0%5D,as:%5B62~728.90%5D%7D%7D,%7Bsl:o,t:327,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B3~0%5D,as:%5B3~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tUns2NG+11%7C1211%7C1212%7C1213%7C1214%7C1215%7C1311%7C1312%7C1313%7C1314%7C1315%7C14%7C1511%7C1611%7C1612%7C1613%7C1711%7C1712%7C1713%7C181*.1686316-75378124%7C1811%7C1812,idMap:181*,rmeas:1,rend:1,renddet:IMG.qs,siq:292%7D&tpiLookup=ao:welovesa.com%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:4bc5:af65:77bc:c3fd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 ibm_plex_sans_500_normal.ttf
s0.2mdn.net/sadbundle/7306017839684792401/fonts/ Frame 448B 173 KB
80 KB 14ms
13ms Font
font/ttf 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7306017839684792401/fonts/ibm_plex_sans_500_normal.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11ddde88c29ef7e51f5c03da7fde285085469879139d006f631a62dba9bbd069

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7306017839684792401/index.html?ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 25 Oct 2023 21:58:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 585677
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81411
x-xss-protection: 0
last-modified: Fri, 22 Sep 2023 12:31:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Oct 2024 21:58:53 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CFA 43 B
215 B 289ms
101ms Image
image/gif 2600:1f18:1aca:4280:4bc5:af65:77bc:c3fd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1686316&asId=3338756e-daf0-1900-92f3-c08218c7ae2b&tv=%7Bc:sJQGqE,pingTime:-2,time:364,type:a,im:%7Bsf:0,pom:1,prf:%7BbdA:31,bdZ:214,beA:395,beZ:397,mfA:656,cmA:658,inA:658,inZ:663,prA:664,prZ:676,si:687,poA:688,poZ:709,cmZ:709,mfZ:709,loA:725,loZ:729,ltA:759,ltZ:759,mdA:397,mdZ:453%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.108,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:728,h:90,t:290%7D,%7Bpiv:0,vs:o,r:l,t:327%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:1,cnod:1,gm:0,slTimes:%7Bi:0,o:364,n:327,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:290,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B62~1,0~0%5D,as:%5B62~728.90%5D%7D%7D,%7Bsl:o,t:327,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B37~0%5D,as:%5B37~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tUns2NG+11%7C1211%7C1212%7C1213%7C1214%7C1215%7C1311%7C1312%7C1313%7C1314%7C1315%7C14%7C1511%7C1611%7C1612%7C1613%7C1711%7C1712%7C1713%7C181*.1686316-75378124%7C1811%7C1812,idMap:181*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:1,renddet:IMG.qs,siq:292,sinceFw:71,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231030/r20110914/zrt_lookup_fy2021.html?hello=world&fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:4bc5:af65:77bc:c3fd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Nov 2023 16:40:10 GMT
server: nginx
x-server-name: dt15.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame B3EA 0
0 55ms
54ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsus7Oi2RvRfgFrhcwV0TaDeDkVPki3Us40zFgQgKdx_dq8fsUaywjIKryxrfOFc9UCot9qTCi3qUw5X5Mf_Y6Er8Mx8bSvhZb4JQThKGCByODg439dgzcgqF95eRVLfEfq1jR5Ap2rfr7UvAHypDvkMTnRbrBG9woG5otwIsMMorreDVIGJLk1-sh08HOe4-zHZZa7h0LPH7wflo6f6k5wbnZy50e9aEfGbRucnMxjBUXO_khRaCdGL2WG37R_jvf8APuGgAohBGy3rEJSF0Xht3XjvESuFMzQDl_hMq-JNdS0ZCso1Tx_s1-Rfpy9HFjfE4zIzHMV6AEOx1Oesp0Y3kMiTiPBhDhm3BlfRVSm4VUWaT_frnfcRqjN1ZLj-y1_khV1w1hmanVQOsR8fzELPmLvIhPmsRLalv4hCKdMPPCKSuSweCv-SCTd5MHUmbrSJHqy2Ej1toTYnMZX2AsDdSHXaZJqu-odQCFTj54OTKYBFrwZC5WAPQjkshoGhw_Z1ODXEDDJRLcaq0k4P1PhMy-bi-sZRdmNlZTQSLeMUB3Dw9GAiBjsFY06dVo9cnrdOWf2OmrmzRMPmNG1y1_WWiIZ4gnvuMlcbEP_3l9hxPYtnteLlmE_JVIOjNK83FzR4hdb0qbzEWD38_QVrYsutkn6Mn1QDDm2C4jWPadjC175C8bdcTPRZre_R72RrJKjsCC8yqtS_g3GW6ddVXTk93_fJGcC2-ioQdtdEHgyuO2l22pQ9UegVM-NDL2m9At6DU_lrqHQ_qNQKeca8-dYEdgyCD7DGnygFutupIfqWsn-dd7LBEwBsYRWIl6S3EWQm15GV1LHf3w84mpCOhZmInrY6mtdHjL248fqJUh1FQ5CBhYebFfjvpK1sAxNTRrQeId0wJi1nxUfZKtAgIJtc2o6KSgbIqciGpOptF4tlrllAuSXLp5YBZY2zQcEny0DGEzRMgkP1VXwOdKnuOogWZw_vRo_GacDxm-S8OvIZhRMzJF4VzinBeTYeHKTdm9PGfmDTe64PMH2fCTL3I0CjgiIuhuwGchj-WDwQxZSd6WOqqKucDDuUshqMib-QS_SymKIiiAWSm-5aLpjnZKH3XA5Kt6lD7hbIKnGISoXSld3iZ1Rqu9zxJkKl98QGvrKK31KkxwHfbp0kseCljdMq1NbJYK570NvNmshDzKB4aqERkmiUQ4w&sai=AMfl-YTIOVHV_HT_7yAZeGktQtF9ZoqU_lTia_vLnGK-zB66SUQIr_erOYiLDXvpo_sDu1WXTA0r1WuHseVq0gNF05_nHtBkBOCi48Bwpz4hnXGPUD7TGnYquUOtdQhS7CvCnQfHzCEAj-cUoaGliMyWnE7VaNh-7y_wQBhtDdNq5R8g08V_PHjIT3BNiUrEpCAfJvjD4Uz85UzZDepdwA9HwhuqU9bRl4FK7ipFiT_4ayMUVCf19gXjeCosY6xKtpIMlGLOBSQ2u8OMkE1p7hRa0HwF1cB3Cp8JMiOLxl4Zu7ZxtFHpLWQ2Axs82d9tjmh6iJ23WfQa5Jx6o7tMDlQzyprfKX2WGoi8z9psh7j3cL-zTBm0CrnH84AmF4gHqTYP7etqIbpDN7QEd_bkcD8DIXjv8eb48qzWk3pwAY0yi2aUMESjvjuAdaMDuBDtebgup0o6ql_NwZp4gWYVHDZzwXKsNlQxsb6JhyBSy-Yu&sig=Cg0ArKJSzBfHsqwm2pBhEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=830&vt=11&dtpt=506&dett=3&cstd=319&cisv=r20231026.97952&arae=0&ftch=1&adurl=

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 01 Nov 2023 16:40:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame B3EA 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ca8116cbfcd273f668d18a5cdf4513e3d1ab6e3f6cf88419d5ac479d1a63a7d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 EHo6i7O_0JOvtrr8dxlkDoYuw_rm2628d10tqmkoAl4.js Show response
pagead2.googlesyndication.com/bg/ Frame 59E5 38 KB
15 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EHo6i7O_0JOvtrr8dxlkDoYuw_rm2628d10tqmkoAl4.js

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

107a3a8bb3bfd093afb6bafc7719640e862ec3fae6dbadbc775d2daa6928025e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 23:47:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 492761
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15078
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 11:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 25 Oct 2024 23:47:29 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 89EA 0
0 52ms
52ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuP4WoLH5SXs9zQdsZdcu6eRSZHQH5rolYTVGQYS8BxLNQl8z_LjSlwgKeVjpMUY1C0pJRM-NToKdQRDV3AqURMw2NewhbE2hNaeM8U-X0zmRCZwlt61Ct64OkJ7rHj6ACtxUkYkwuAtVCnQ2kObFO6mFshUku1YqbEL7VCc2O3CktAZ3RBzDql0MrxoKk1UChz_lVh0SGZXhdgY6SYlPNxNMK56pvxEZeXcFeG6boV4PXM0o2_MRioI8RRPJ7WFpR4J0D9gU2wBrvADVpPC64piNN_plzCatCB_zoaLaTT536dgZTUBnxPFc_x2oy94zkwnNGol00ENB8iwFOtNLNOmzrEGQjvkB13M1uUwTCxctsIiH-V7RXT5LZcgyMibsvA0XpFwsCZ4tDN3_tJPEKY7diV5mli8eFMMNUMr6Rypkk5OfjMGs-EXYckMmVeHpDTibEu0e3Mc0IVmKOSO3A9ICreOcrGjZdz3TXsviuPxxkymkNRfiU01I1Ai2liHSPuzQRBqp79xNP8AB8uy5WdEUry2s6fYvVMuLZTWwAX0PRAffghhEh0slezyfJ9uqhj7Z23x3I_rEfdmnDeehJZBNt1gLI3GRyGDfAJN4VamI3vMB2yuhJRN2UQ7TSvAjY-FYtp7z7If01NlrYHxhi5mH_yKaDFDJ16c1L1Ye8yH8_wtR9aTKTAbYB-5ozJhyTUIojxC8tJU4FGvJ1hGrEXrnzRQQRJ2NnwsXi92yfkpXa-oDCoSiT3ZeUQA4EfkZtEaJ54Nof7a5SAXNt5maCwHTta2ouMZ2wcQ3tLA93QIfzsiDy7AC8z06jD_HOYDPlZKJJGhHe8bp1wYeEEB927306AW_RKCOgP7t1oXyk6YYYyXbKAF4edyljCYw_JzVFdTBbMspXbAVUP9KcXFZ82BKq-76alGpmAJKw7STg-VPBJU5bdLPB93Kt4orgh7Uw2U_Md57ToUp95Q8CtDQOTPqwV10-GA54jdjbvkse5hkpVzcivkIfkom9REFeWbj9imt6myMBwocyVPWPqspTpxKbQHBuPlR6xWOSTCM98jI58deUTEVyJv1ZRsTgvRI2Q2GMgbChJbv1G3H-2ffN02tSwin5EUkH3GLduua02gpk8iXncvRBd4mnDRDFrGXQO_6Msuh7mMPtdI07LbaSkDAB6EkTPcbzgl_gqa61Cl36Feuazqxw&sai=AMfl-YT24Swyvj9fhYVR4AQ-cu12OnBX2ibTdNP0uy0Ypv3guwG7yJ2AtpJsiZ7kr0u6c9LToYDYoKerk3Bd3WaHFgRukhPfOszs8ullWz3f2K_wL1V5QMgI9_hdnjjN-AMEmaatLIAqs2D_F87Fszs7XLUL-HLPzEqqLJSCJf7S01KT54ypNMbm0dmkRBozlX8T5Ji0uBxuomcQ7CsUolbNnVH5MGUvAef-6Q4j6mbT5nqlcARtpSUkkVvafgX070dGEat70hwCWmD_Q3-hhhz2AAH05C9-LIhWmEDqbSpsdvdK0DWJdSrZc5OiTJ69ZfhpQ7Ne9EsPEunbbH2vtYKU5RxfAj6ISydmcyA_xapnHsMfjgy2FTpCLdyZvaF2dHiEOnjeBf554gq31k5Lo4f29H9kF2ufT3HZyX8KpAUHuqDQSIqCQefzAsP3rVXl7MpEX_RJ15I6zGB8vxQQx46beUOoDYWZCB0xdu_ZzPXD&sig=Cg0ArKJSzE99Wn8aeAtjEAE&uach_m=[UACH]&pr=missingexchangepricemacro&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=817&vt=11&dtpt=446&dett=3&cstd=368&cisv=r20231026.50677&arae=0&ftch=1&adurl=

Requested by

Host: welovesa.com
URL: http://welovesa.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS