simcast.com Open in urlscan Pro
45.79.244.12 Public Scan

ec2-3-125-36-210.eu-central-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

7061c8bfc4e20040ca3d84673db18c930384e9256563a5db2e004e0706d341b1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
an-x-request-uuid: fde86bbe-4591-48a7-981c-6452a09f81ff
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.40; 81.95.5.40; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 139
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame 1ED5 19 B
539 B 63ms
8ms XHR
application/json 3.125.36.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.5.0&referrer=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&tmax=3000

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.125.36.210 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
accept-ch: sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink
x-auction-status: 16
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame 1ED5 0
159 B 41ms
14ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://simcast.com
pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ Frame 1ED5 23 B
460 B 60ms
40ms XHR
text/javascript 18.66.138.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&pr=http%3A%2F%2Fvodafoneidea.ph%2F&pid=XAh7ZcKUWCDZJ&cb=0&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22id%22%3A%22standard%22%2C%22mt%22%3A%22v%22%7D%5D&schain=1.0%2C1!stnvideo.com%2CVRAfdwVZOg7jMyH8bxgoOA%2C1%2C%2C%2C&pubid=6c3f03cd-6fa8-4477-ac05-2c0f4f8da092&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.138.185 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-138-185.fra60.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:46 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 7efdfc8e9ebc26758933b0151e22707e.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P4
x-amz-rid: 4FC0C18JBGWMRDSN230S
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 1STAEdQuWV6D3wvVkMJzb7ibIXSeX3qMSAtJuv2k5C9MTyJuwE6txw==

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 28ms
13ms Preflight
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Mon, 27 Nov 2023 06:00:46 GMT

GET
H2 200 gcid_s.min.js Show response
p.gcprivacy.com/t/ 12 KB
12 KB 32ms
8ms Script
application/javascript 18.66.122.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://p.gcprivacy.com/t/gcid_s.min.js
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.50 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-50.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5845423fa671b1f437768658bc1424ba2f089f85a8645e102bee9608a73e7e7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: VAq4q9ukaYshS6vfUaowIF9rM2JrIXC2
date: Sun, 26 Nov 2023 09:10:11 GMT
via: 1.1 375431e28d82888f474ac3665a4ceb66.cloudfront.net (CloudFront)
last-modified: Tue, 24 Oct 2023 12:34:22 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 75036
x-amz-server-side-encryption: AES256
etag: "ec6bb0b9d5dd7f05019f70766eb4a9b2"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 12142
x-amz-cf-id: QzgB6ICW4e9aRBoct12387jvErLv2LQbqp8A8C636iPJB8hXATDvmg==

POST
H2 204 prebid Show response
ib.adnxs.com/openrtb2/ 0
516 B 44ms
29ms Fetch 185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/openrtb2/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
an-x-request-uuid: cdb25915-a277-4c1b-9b68-75b72e70cf6e
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.40; 81.95.5.40; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
166 B 59ms
13ms Fetch 145.40.97.66
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.97.66 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

x-nbr: 1
date: Mon, 27 Nov 2023 06:00:46 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0

POST
H2 204 pb Show response
ad.360yield.com/1914/ 0
165 B 143ms
35ms Fetch 52.19.11.170
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.360yield.com/1914/pb
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.19.11.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-11-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Mon, 27 Nov 2023 06:00:46 GMT
access-control-allow-credentials: true
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
190 B 215ms
188ms Fetch 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.21.0&cb=41973010178&lsavail=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Mon, 27 Nov 2023 06:00:46 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
313 B 26ms
26ms Fetch
application/json 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=949296
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb132b1be3f72f95b24feb01238c5663076cfc3227053354bf9731f7a1b938f2

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CUbXvoCJlGKt%2BhFg8l5Sl11%2FQbrhb7cSxpxDP%2B0rUVe3y9HP6fAWv1unBtOcmrYS5eU2UrwU6a0cmAbZs1U70A%2FLQYmbe8z7Gggv52c8WAjrtGNSf4PTy0LLhf9Qb7J1hPz%2FBCnp"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 82c8271baf1e37ca-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 24 B
362 B 388ms
83ms Fetch
application/json 18.197.47.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.47.48 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-47-48.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ade5a56f3f422d8e7dc2d5e1402d004e1224bad18f34fc36ae19d80127114b7a

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 27 Nov 2023 06:00:47 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 49

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
408 B 33ms
8ms Fetch
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://simcast.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
377 B 89ms
53ms Fetch
application/json 95.101.149.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-35.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Mon, 27 Nov 2023 06:00:46 GMT

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 600 B
496 B 997ms
476ms Fetch
application/json 2a0c:5c87:5241::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c87:5241::2 Cricklewood, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 442969caeb1da811e98a138fa73781fcebc966274afc04bfea71788109d0294f

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 27 Nov 2023 06:00:45 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 190

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 2 KB
2 KB 103ms
60ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQWX43D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: a40ef52f51404c64ffdc80cb2ad80480819c0db981f6354d5d2a89f26aba0111

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 44
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 06:00:46 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
158 B 55ms
28ms Fetch 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://simcast.com
pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
572 B 29ms
26ms Fetch
application/json 185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
an-x-request-uuid: ecc96409-1a77-48b9-8505-bb705fa31e83
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.40; 81.95.5.40; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK pbjs Show response
smartssp-us-east.iqzone.com/ 2 B
238 B 318ms
127ms Fetch
application/json 8.2.111.102
NATCOWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://smartssp-us-east.iqzone.com/pbjs
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 8.2.111.102 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Access-Control-Allow-Origin: https://simcast.com
Date: Mon, 27 Nov 2023 06:00:46 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Content-Length: 2
Content-Type: application/json

GET
H2 200 anonymized_small_black.png
storage.googleapis.com/idw_static_assets/ 2 KB
2 KB 26ms
6ms Image
image/png 2a00:1450:4001:80f::201b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/idw_static_assets/anonymized_small_black.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::201b Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 05adb1a8ab31ced159adf8401bc91d0c28dc75777423ea84358b9565147b5925

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:42:16 GMT
age: 1110
x-guploader-uploadid: ABPtcPqGRG2a_yvsBfeS49EFT-PnQYTyYdD02zmOisZX-CViLGFY2Z9SR_kSg-fsvONUo2oPK8diM3_THw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1661
last-modified: Thu, 02 Feb 2023 09:54:23 GMT
server: UploadServer
etag: "d0042077edcb1feff233a5a0e095b327"
x-goog-generation: 1675331663329867
x-goog-hash: crc32c=A2Z1Vg==, md5=0AQgd+3LH+/yM6Wg4JWzJw==
content-type: image/png
cache-control: public,max-age=7890000,no-transform
x-goog-stored-content-length: 1661
accept-ranges: bytes
expires: Mon, 26 Feb 2024 13:22:16 GMT

GET
H3 200 bidderchecker.js Show response
static.anonymised.io/light/ 961 B
418 B 8ms
8ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/bidderchecker.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 722a4121ccf998eefa71a33203ddd5e99a0ba3243c0549cdf7302268fe0ba979

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:43:38 GMT
content-encoding: gzip
age: 1028
x-guploader-uploadid: ABPtcPrdYgMuAb01XiMdcEXsljXxJ75QKhD_qz8VLQP6Mrn0mw1pRvqeL0MABNQ9RyxOI1P0YaE
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 387
last-modified: Thu, 23 Nov 2023 10:26:17 GMT
server: UploadServer
etag: "c823940225f29e44ae91bea87032c47e"
vary: Accept-Encoding
x-goog-generation: 1700735177845152
x-goog-hash: crc32c=OnUtBg==, md5=yCOUAiXynkSukb6ocDLEfg==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 387
accept-ranges: bytes
content-type: application/javascript
expires: Mon, 27 Nov 2023 06:03:38 GMT

GET
H3 200 timeme.min.js Show response
cdnjs.cloudflare.com/ajax/libs/TimeMe.js/2.0.0/ 6 KB
2 KB 13ms
13ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/TimeMe.js/2.0.0/timeme.min.js

Requested by

Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5725f04fd1f8882b1d02561933d648bb1a91349b0f33031e78ce0668d3751db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 457312
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1532
last-modified: Mon, 04 May 2020 16:04:02 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf2-163a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BEpS2B0PFQ6zerhcacR3tSZ3ATSWl0oclviyX2RYvbTjqzqdRU39WWADlW9cvWTM9s55dLoDkZF8kLVer11fthtF4Die6AktFNpMcoYNkRNdXJCZnllmY33BqZqk%2BNQKa%2F3qIwWEAeMEXT0k6Hwn9%2Bp0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 82c8271bd87990e6-FRA
expires: Sat, 16 Nov 2024 06:00:46 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
241 B 36ms
15ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RFSL1NPH34&gtm=45je3b81v9124667839&_p=1701064845929&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=85971985.1701064846&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1701064846&sct=1&seg=0&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&dr=http%3A%2F%2Fvodafoneidea.ph%2F&dt=Simcast%20News%20portal.&en=page_view&_fv=1&_ss=1&tfd=2490
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RFSL1NPH34&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
202 B 14ms
14ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=378375595&t=pageview&_s=1&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&dr=http%3A%2F%2Fvodafoneidea.ph%2F&ul=en-us&de=UTF-8&dt=Simcast%20News%20portal.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=234293263&gjid=830000081&cid=85971985.1701064846&tid=UA-205158314-1&_gid=1513086124.1701064847&_r=1&gtm=457e3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=33635129

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ Frame 1ED5 96 B
286 B 105ms
105ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=694&sync=0&domain=simcast.com&url=https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&ref=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&_it=amazon&partner_id=694
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 458793afaa87ed3a42bc8cd5bf69756f2c7b3780db3fd8d1eb2c880a67e9c1e8

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:46 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 82c8271cfe6f3764-FRA

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 147ms
107ms Preflight
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=694&sync=0&domain=simcast.com&url=https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 82c8271c5dfe3764-FRA
content-length: 0
content-type: application/json
date: Mon, 27 Nov 2023 06:00:46 GMT
debug: OPTIONS block
expires: Tue, 26 Nov 2024 06:00:46 GMT
server: cloudflare

GET
H2 200 sync Show response
p2.gcprivacy.com/v2/ 451 B
815 B 97ms
97ms XHR
application/json 3.217.130.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p2.gcprivacy.com/v2/sync?pid=Q6CV1VBC&uid=3ce9a34c-31b3-48d9-80be-255f54a18cf5&u=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&h=simcast.com&ref=http%3A%2F%2Fvodafoneidea.ph%2F&ids=sharedid%2C3ce9a34c-31b3-48d9-80be-255f54a18cf5%7Cquant%2C%257B%2522value%2522%253A%2522P0-1000072351-1701064846327%2522%252C%2522expiry%2522%253A1734933646579%257D%7C&v=3
Requested by: Host: p.gcprivacy.com
URL: https://p.gcprivacy.com/t/gcid_s.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.217.130.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-217-130-42.compute-1.amazonaws.com
Software: /
Resource Hash: d1e9229a81d06e369f755b8ffa2f5dcaa7e297f0164e1467f6e66920c8de18fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:46 GMT
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Max
content-length: 451

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 66ms
52ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231109&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f9799ce2ddefc62e037adbb49af1d40f6dfb002fa7cc5927a9dbd9f3fb6c35ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12351
x-xss-protection: 0

GET
H2 200 pss19272p20pn33599q2q55p43qqr5n8.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/ 379 B
970 B 7ms
7ms XHR
application/x-mpegurl 18.66.97.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/pss19272p20pn33599q2q55p43qqr5n8.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 519d1614decbc4c580f2094ac02973be8c2275e1e8766f06d0f83c55fc70c186

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 21:22:14 GMT
via: 1.1 891011d51eb2353ebe8601f5b6467070.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 31113
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 379
last-modified: Fri, 24 Nov 2023 21:02:18 GMT
server: AmazonS3
etag: "7aaf56065c7a167abc1a68e2bc98f847"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: FbLB-RZVHF4-DnXRRZQev15Uk5PA-zOOe-O-R3UHUOciZv_TWwqrLA==

POST
H2 200 player-event
events.qortex.ai/api/v1/ Frame 1ED5 0
0 230ms
195ms Fetch 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/bootstrapper
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q59lR5O1qdeqFjmP5aMySwUa9AkzAKhWk6i5K4fvFCu7FnxA1MKebq4PXdhgvhflGac0QJJwNl4APx9DFcKC7%2BQ%2B6C1FegnoToTr3OGww1lWHykoqlR5IUJihBFBJs9bICHKzi%2FpSSNZrRQ6BBY%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c8271caccc6931-FRA
content-length: 0

GET
H2 200 cx-bootstrapper-init Show response
tags.qortex.ai/cxo/ Frame 1ED5 49 KB
9 KB 15ms
15ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/cx-bootstrapper-init
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/bootstrapper
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ba7e0e72735ea304bac8a43e87c2da1b7ee2d6705e8548a2fde134beb08d7b48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 12
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DLQNRrdY8S9syZn%2BepxKad7nmebOttMfRGmpIVQ7bm%2BsL7l5j5sS%2BkfKtFUhikLg77NhKtnuzbRL8H5bHUZDbqbqkGLtphVFLpc3IASbxeyR3vaLgMYR835hzLOAIyFPUQSWe3%2B3MWFiHuhY"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c8271c7804bbfd-FRA

GET
H2 200 init-3392tkd9ir9ggbv3f0mu.js Show response
api.fouanalytics.com/api/ Frame 1ED5 0
311 B 209ms
183ms Script
text/javascript 2606:4700:e4::ac40:a917
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.fouanalytics.com/api/init-3392tkd9ir9ggbv3f0mu.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/bootstrapper
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a917 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v3TdZw40e6zfb8oLtRddPQQhVEs8K866XfErTKVx5K%2Bk7WcuDthWIdohs5IrJi5ZdIPoegUJWoW5rxa9O4Pa9UfEEMtQwpaWa%2B4VOX3hWXUcv1INSV%2FBLzeOaPQQIy%2B%2FMQpyPRJNs7bdSG%2BNuUez%2BIzugA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
cf-ray: 82c8271caffd1c1c-FRA
alt-svc: h3=":443"; ma=86400
expires: 0

GET
H2

200

redirect.gif
fa.aidemsrv.com/api/ Frame 1ED5
Redirect Chain

https://api.fouanalytics.com/api/noscript-3392tkd9ir9ggbv3f0mu.gif
https://fa.aidemsrv.com/api/redirect.gif?DFD9bDCzqPF7IYfj

45 B
748 B

218ms
191ms

Image
image/gif

2606:4700::6811:2c5d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fa.aidemsrv.com/api/redirect.gif?DFD9bDCzqPF7IYfj
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0
Protocol: H2
Server: 2606:4700::6811:2c5d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dacc3415ac477e2881e621274425641e828cf53353de1d392e14a4f067b42c6f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2s0Y6No07HTTkEVmoIZT0ubv27mfzPJ3q452fOfyH88ZLOuBL%2F8U4VF%2FIdU4A%2BJHp99TuhZw033zG2A%2BRG%2BScg5fAuTemTzyy1uJUegiu0%2F%2FF3pmhSojx2KE9VD1csppP3qbkp1QLXE37l2Adw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
cf-ray: 82c8271deb9d922c-FRA
alt-svc: h3=":443"; ma=86400
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=92otevGrGm3iM1MOyKwkWH%2BfBKhq%2FZjEaoJqdcDP1rLnSB3kmgdhAYOQ2BavGtRxe1nLw4yKfrVftDUm4aXx4tGR6cILeGzS54JVOP6uT881rC6PDWDqaagydpzpWEfhow068G%2BH0yKRj52G3%2BMpOFEBLg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
location: https://fa.aidemsrv.com/api/redirect.gif?DFD9bDCzqPF7IYfj
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
cf-ray: 82c8271caffe1c1c-FRA
alt-svc: h3=":443"; ma=86400
expires: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 39ms
19ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 27 Nov 2023 06:00:46 GMT

GET
H2 200 js Show response
aggle.net/ 202 B
658 B 461ms
148ms Script
text/html 3.33.163.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aggle.net/js?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Requested by: Host: p.gcprivacy.com
URL: https://p.gcprivacy.com/t/gcid_s.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.33.163.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a938864f9581ea3da.awsglobalaccelerator.com
Software: gunicorn /
Resource Hash: 832ecde2a95e0b6b350be4b477050177facd60d8b645a99aef680e64f9132419

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Mon, 27 Nov 2023 06:00:48 GMT
date: Mon, 27 Nov 2023 06:00:47 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: gunicorn
content-length: 202
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2

200

xandr
p2.gcprivacy.com/v3/id/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fp2.gcprivacy.com%2Fv3%2Fid%2Fxandr%3Fid%3D%24UID%26gcid%3D5cb2bc40-dd42-4472-a38e-10c4d678f0e2
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fp2.gcprivacy.com%252Fv3%252Fid%252Fxandr%253Fid%253D%2524UID%2526gcid%253D5cb2bc40-dd42-4472-a38e-10c4d678f0e2
https://p2.gcprivacy.com/v3/id/xandr?id=3814733643143270550&gcid=5cb2bc40-dd42-4472-a38e-10c4d678f0e2

0
37 B

96ms
95ms

Image
text/plain

3.217.130.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p2.gcprivacy.com/v3/id/xandr?id=3814733643143270550&gcid=5cb2bc40-dd42-4472-a38e-10c4d678f0e2
Protocol: H2
Server: 3.217.130.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-217-130-42.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:46 GMT
content-length: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
an-x-request-uuid: 0d0be9ee-dcee-461a-8643-6042b7d8a07d
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://p2.gcprivacy.com/v3/id/xandr?id=3814733643143270550&gcid=5cb2bc40-dd42-4472-a38e-10c4d678f0e2
x-proxy-origin: 81.95.5.40; 81.95.5.40; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7740 13 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 39066
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 19:09:40 GMT
expires: Mon, 25 Nov 2024 19:09:40 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6A15 829 B
1 KB 38ms
17ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ffcf0950cfeb298d41a8cde8f5dd2a6f155d6f84c1736352d03b961e9aa461be

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Dx4adrEx17q9AsADIg7YVA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-Dx4adrEx17q9AsADIg7YVA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:46 GMT
expires: Mon, 27 Nov 2023 06:00:46 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 7740 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71038
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Nov 2024 10:16:48 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6A15 0
0 40ms
40ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231109&jk=1377815174196728&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 7740 0
10 B 6ms
6ms Image
text/plain 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?fV6X6A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:46 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 91ms
90ms Ping
image/gif 54.235.91.236
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=JfQVDXjNQ_FbGWml&instance=214538861&version=7.26.0&age=231127&ldt=BIDS&key=jmgEr5Ik&c_id=12018&seq=1&order=5&vIndex=0&absoluteTime=2755.5&relativeTime=746.2&sm_id=3195563&visiblestatecd=I&soundcd=OFF&alt=0&sC_ID=8783&load=1&status=LVFNLNIY&ac_id=2008&bidIndex=1&prebid.cid=0&prebid.bidders.undertone.time=340.5&prebid.bidders.pubmatic.time=92.8&prebid.bidders.ix.time=80.2&prebid.bidders.rubicon.time=110.4&prebid.bidders.appnexus.time=77.7&prebid.bidders.triplelift.time=83.3&prebid.bidders.unruly.time=102.9&prebid.start=2414&prebid.time=340.9&prebid.timeout=3000&adIndex=-1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.91.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-91-236.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 694 Show response
a.ad.gt/api/v1/u/matches/ Frame 1ED5 12 KB
4 KB 54ms
16ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/694?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&ref=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&_it=amazon&partner_id=694
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd4d035b67f26f67b2cf2b55014c2c290c50fd9110bb9df9ceb0f9417590143d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 27 Nov 2023 05:58:57 GMT
server: cloudflare
age: 110
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 82c8271de9ba1cbd-FRA

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame BFA0 156 B
145 B 238ms
224ms XHR
text/xml 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?slotname=%2F92056281%2Fsimcast.com-premium&sz=480x270&ciu_szs=300x60&cust_params=sessionKey%3D214538861-JfQVDXjNQ_FbGWml%26schain%3Dstnvideo.com%2CVRAfdwVZOg7jMyH8bxgoOA%26content%3D8783%26placementType%3DPremium%26embed%3DjmgEr5Ik%26domain%3Dsimcast.com%26player_size%3Dlarge%26player_width%3D761%26player_height%3D428%26player_type%3Dfloat%26version%3D7.26.0%26player_status%3DLVFNLNIY%26play_code%3D2008%26view100%3D1%26excl_cat%3Dstl_id00157%26rand%3D4%26uhr%3D07%26us_privacy%3Dfalse%26keywchk%3Dok&url=https%3A%2F%2Fsimcast.com%2F&unviewed_position_start=1&output=xml_vast4&env=vp&gdfp_req=1&ad_rule=0&video_url_to_fetch=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36%2Cgzip(gfe)&vad_type=linear&vpos=preroll&pod=1&ppos=1&lip=true&min_ad_duration=0&max_ad_duration=250000&vrid=1263268&us_privacy=false&hl=en&cmsid=2631244&plcmt=2&vconp=2&video_doc_id=3195563&vpa=auto&vpmute=1&cnc=22632072816&kfa=0&tfcd=0&sdkv=h.3.605.0&osd=2&frm=0&vis=1&sdr=1&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&u_so=l&ctv=0&mpt=stnvideo%2Fplayer&sdki=445&ptt=20&adk=2858638697&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.605.0&sid=273BD974-3466-41C5-9F74-AE9E2C862741&nel=0&eid=44772139%2C44777649%2C44781409%2C44802074%2C44802463%2C44804291%2C44806075%2C44806632&ref=http%3A%2F%2Fvodafoneidea.ph%2F&top=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&loc=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&dlt=1701064845504&idt=914&dt=1701064846986&cookie_enabled=1&correlator=256898687376385&scor=1391933334590865&ged=ve4_td1_tt1_pd1_la1000_er0.0.0.0_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect.min.js Show response
static.anonymised.io/light/ 5 KB
2 KB 8ms
8ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/collect.min.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4421d90bbf983478021bbc14981742e33af47dcfbbbbd2df44b975257fde30cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:43:57 GMT
content-encoding: gzip
age: 1009
x-guploader-uploadid: ABPtcPpsgLCJuMGPfTc_vnj7HdGXU2KC63WpL9bj3HTuvQCekMTIKguaDbrPiVIi4S52noRk2ZFXuzchCw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1975
last-modified: Thu, 23 Nov 2023 10:26:21 GMT
server: UploadServer
etag: "81cccd3b6fb0900a54795428e0046323"
vary: Accept-Encoding
x-goog-generation: 1700735181247079
x-goog-hash: crc32c=ChCSZQ==, md5=gczNO2+wkApUeVQo4ARjIw==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 1975
accept-ranges: bytes
content-type: application/javascript
expires: Mon, 27 Nov 2023 06:03:57 GMT

GET
H3 200 interestscores.js Show response
static.anonymised.io/light/ 3 KB
2 KB 7ms
7ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/interestscores.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 0409134df4107fe3d86b26248e3e8253287e929e94b690173bbab16e35686cd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:44:09 GMT
content-encoding: gzip
age: 998
x-guploader-uploadid: ABPtcPrYXKXVtkILNi0lI_qXk9yKPPEudOqA6Yg-Z2dBSTLYq-X3vHen8XfCS1J7PUzb-cL8ga0SHe-y-w
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1601
last-modified: Thu, 23 Nov 2023 10:26:23 GMT
server: UploadServer
etag: "bbe7bbf9f934282283577ce6457f7f33"
vary: Accept-Encoding
x-goog-generation: 1700735182971710
x-goog-hash: crc32c=rzbcSQ==, md5=u+e7+fk0KCKDV3zmRX9/Mw==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 1601
accept-ranges: bytes
content-type: application/javascript
expires: Mon, 27 Nov 2023 06:04:09 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame BFA0 0
234 B 126ms
40ms Ping
image/gif 2a00:1450:400f:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lpgi37sn&c=3140791085647&slotId=1570395542823.5&eee=missing-element&bi=missing-id&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400f:80c::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:47 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 91ms
91ms Ping
image/gif 54.235.91.236
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=JfQVDXjNQ_FbGWml&instance=214538861&version=7.26.0&age=231127&ldt=NO_IMP&key=jmgEr5Ik&c_id=12018&seq=1&order=6&vIndex=0&absoluteTime=3011.3&relativeTime=1002&sm_id=3195563&visiblestatecd=I&soundcd=OFF&alt=0&sC_ID=8783&load=1&status=LVFNLNIY&ac_id=2008&adIndex=-1&DS=found
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.91.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-91-236.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 p
sb.scorecardresearch.com/ Frame 1ED5 43 B
298 B 29ms
8ms Image
image/gif 18.245.60.72
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=18065638&ns_type=hidden&ns_st_sv=6.3.4.190424&ns_st_smv=5.10&ns_st_it=c&ns_st_id=1701064846462&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=31197&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.3.4.190424&ns_st_pn=1&ns_st_tp=1&ns_st_ci=3195563&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_ap=0&ns_st_dap=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_st_ldw=0&ns_st_ldo=0&ns_ts=1701064847232&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=770&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc12&ns_st_ge=Sports&ns_st_st=SendtoNews&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Cheddar%20News&c3=sendtonews&c4=Business&c6=*null&c7=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&c8=&c9=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.60.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-60-72.fra60.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
via: 1.1 7dbea139a5c4f501bc4b0e9d19a50c9a.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P5
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: oqEzGxPStdEsQcN1AmRT0mg_5juruARE9V1sN7q-GXtc3l_hzyLYsA==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 91ms
90ms Ping
image/gif 54.235.91.236
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=JfQVDXjNQ_FbGWml&instance=214538861&version=7.26.0&age=231127&cmd=INV&key=jmgEr5Ik&c_id=12018&seq=1&order=7&vIndex=0&absoluteTime=3017.7&relativeTime=1008.4&alt=0&sC_ID=8783&sm_id=3195563&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=vodafoneidea.ph%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=vodafoneidea.ph%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.91.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-91-236.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 91ms
91ms Ping
image/gif 54.235.91.236
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=JfQVDXjNQ_FbGWml&instance=214538861&version=7.26.0&age=231127&cmd=PLAY&key=jmgEr5Ik&c_id=12018&seq=1&order=8&vIndex=0&absoluteTime=3018&relativeTime=1008.7&alt=0&sC_ID=8783&sm_id=3195563&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=vodafoneidea.ph%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=vodafoneidea.ph%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT&pposition=home
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.91.236 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-91-236.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 jsync Show response
aggle.net/ 325 B
977 B 157ms
157ms Script
text/html 3.33.163.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aggle.net/jsync?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Requested by: Host: aggle.net
URL: https://aggle.net/js?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.33.163.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a938864f9581ea3da.awsglobalaccelerator.com
Software: gunicorn /
Resource Hash: 09457ac937548db29b31139a069ef87808ccfd95021a635414589e46a22d8726

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Mon, 27 Nov 2023 06:00:48 GMT
date: Mon, 27 Nov 2023 06:00:47 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: gunicorn
content-length: 325
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 46ms
45ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231109&jk=1377815174196728&bg=!GRqlGlXNAAZxrfrxUa07ADQBe5WfOJge8fxPV5hT-NFMFu5jkbJJrvOseM7MTiPnbC7WCxuNTej8Mtj_CJSNPfKj8a8oAgAAADhSAAAAAmgBB5kCvWHnRlL1GoeCQey4zQ4ZrVnJqXjwwtS3zF9EwGUUalXKEiewubeceQw7WhUR6J4EwVcmkR4qd1jNk9EOSaY1VCx5OXfPHbRPpa2UxFbtW7C3uBpwj1vP10ADd2wK6xrQxzmhgKP0hZ5gCG0nAy-fafUQWJpGUKYh9R4dRap4YyguUZZfbbzAXYhUBDRT8SnEtqAXYhiDQ7JHtP1m5rJyFEFDyXNtydHSCbNGHxzu0ZzWu4mGBhmIdr72vV8P7InHdIZeFbWaCAhzu3T2qeyLmu46_6GZfIiCdKzq48ctbuYjWoevD61HhMyIN0wh-sehKNVILZQQ7kexFk3bXRZBhMATw4cWtnc3xCC94wM-C4aw6WpxLeDWckrv7c9DQJtuWJxhmhpkryawEkmvFeJUj-qVpkeDrs4OWuJ8woMJzz9f9dWDKUVGbQaiGsWgWkQSJOCkr__leqg2Wp6nHPQzWQ__I1dneJRULqn6-8GwkaTg-6uQd1G0t9XekogI4y5QnnDA73ieq1y9BVpQrRV6uQL_OC0zLhuwXu0l9Zye5x2VXzCI7Aczafsqjw2UWqZ4Qgb3mL7PJCY2bUyqXbk3Tt28AuXC4DW87dZRIeuLpLnRtEjtoGIxl16r9eETFSmc15tPOgd6t6wZwsYopa1pFizxTbQh1Vz3Fv3j-vitRqTmozRgDiQkx2t7-NnG9vC-a_0Jp-lZ5YuB8B62aKxg3_3gtqQL4J22nUw37uQ3UiYYJr6vSLmht-ebun9rlJGIEbhYvTqpn9iBgSRhf8stJpThdHebwIpyyd4QReRucXgrGlN84rIXidcbPrGIVlmMmGFc5W21WqFo-VzQOG_tv1AtFmQ8YzvovJqk_C-JlgarqCu24ZDTqFo0hZQp2SxUVQYOsnrKL--dT6jIZZgUKGHJchoGqR9sPLcBNIxA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET cs
a.usbrowserspeed.com/ 0
0

POST
H2 204 csi
csi.gstatic.com/ Frame BFA0 0
54 B 42ms
41ms Ping
image/gif 2a00:1450:400f:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lpgi38fx&c=3140791085647&slotId=1570395542823.5&ghmsh_eids=44772139%2C44777649%2C44781409%2C44802074%2C44802463%2C44804291%2C44806075%2C44806632
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400f:80c::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:47 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 234ms
13ms Preflight
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 27 Nov 2023 06:00:47 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 204884
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
246 B 314ms
94ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002PIxPJAA1&gdpr=0&src=pbjs&ver=8.21.0&coppa=0
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H/1.1 200
OK / Show response
id.a-mx.com/sync/ 66 B
264 B 241ms
12ms Fetch
application/json 131.153.158.209
SECUREDSERVERS-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://id.a-mx.com/sync/?tagId=&ref=http://vodafoneidea.ph/&u=https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0&tl=https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0&nf=0&rt=true&v=8.21.0&av=2.0&vg=aaw&us_privacy=null&am=null&gdpr=0&gdpr_consent=
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 131.153.158.209 Amsterdam, Netherlands, ASN60558 (SECUREDSERVERS-EU, US),
Reverse DNS
Software: /
Resource Hash: c1b8b4c2780d3af037d68d1beb795dc87ae835d223ee2dec47cf81a97cf0f282

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Mon, 27 Nov 2023 06:00:47 GMT
access-control-allow-credentials: true
content-length: 66
content-type: application/json

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
370 B 38ms
13ms Fetch
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: application/json

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 187108
expires: 0

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 227 B
242 B 27ms
27ms Fetch
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=405&_it=prebid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02d9c8262e7af473748bc3fe8ff2b3240feea44368aea2073a8b86347c975b36

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
content-encoding: gzip
server: cloudflare
allow: POST, OPTIONS, GET
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cf-ray: 82c82721fa6b3764-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 135 B
412 B 226ms
8ms Fetch
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

480613f771d4b2960ecbcbf9f0a8435d009d8f5fd10ab14bba1b1018762708e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Mon, 27 Nov 2023 06:00:47 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 204 any Show response
idx.liadm.com/idex/prebid/ 0
367 B 319ms
92ms Fetch 54.84.191.206
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/prebid/any?resolve=nonId

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.84.191.206 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-84-191-206.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
request-time: 1
access-control-allow-origin: https://simcast.com
cache-control: max-age=3599, private
access-control-allow-credentials: true
trace-id: 7bfcfb4a33f55e48
expires: Mon, 27 Nov 2023 07:00:47 GMT

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
314 B 255ms
29ms Fetch
application/json 52.215.24.0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17228
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.24.0 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-24-0.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:47 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.14.223
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H/1.1 200
OK fpc Show response
at.teads.tv/ 0
334 B 258ms
35ms Fetch
text/plain 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://at.teads.tv/fpc?analytics_tag_id=PUB_17018&tfpvi=&gdpr_consent=&gdpr_status=22&gdpr_reason=220&ccpa_consent=&sv=prebid-v1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 27 Nov 2023 06:00:47 GMT
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Mon, 27 Nov 2023 06:00:47 GMT

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 196ms
7ms Script
application/javascript 2600:9000:223c:3800:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223c:3800:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:30:07 GMT
via: 1.1 9015971351bc982a04ee209a022bb1f8.cloudfront.net (CloudFront)
content-security-policy: default-src 'self'
x-amz-cf-pop: FRA56-P2
age: 1840
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8730
x-amz-expiration: expiry-date="Tue, 17 Oct 2028 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
last-modified: Tue, 17 Oct 2023 13:17:45 GMT
server: AmazonS3
etag: "c46e30de24d0f12167e302e9e32ff4a5"
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: JTpnyhThZqmqsig4bW4wnjZkRSLRRcsfsnK38HKTHT4h1ZkyE24MRg==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 195ms
7ms Script
text/javascript 2600:9000:2250:c00:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:c00:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Sun, 26 Nov 2023 10:03:28 GMT
Via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P2
Age: 71840
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: QgdNqgRDN9w4yH8UIxGX2VVPs2lBmz5jpDk9REwYNyRhjk1HmefZNQ==

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 156 KB
34 KB 207ms
19ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22a1257891d7523261ed7426751d43a5dfeb83e2211aed3b71f085b5a45149ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 22 Nov 2023 08:19:05 GMT
server: cloudflare
x-amz-request-id: JKG7GMDXVPEZ9Z6N
age: 759
etag: W/"6d1031a5affe091aafc4dbcf111418ee"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 82c827236c3f4d89-FRA
x-amz-id-2: RIzSPfnJhm/qmmHvFEYhsdzyNaMAcXkXZ3JhRqPQ0Xc67KRyf5HO97g2Qq9KVS1HSLG0L6tE4XQ=

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 209ms
21ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx
etag: W/"653b5c0e-a9a7"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 28 Nov 2023 06:00:47 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 197ms
9ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 17:40:12 GMT
content-encoding: gzip
age: 1167635
x-guploader-uploadid: ABPtcPrYakBZZUaYUT2Aa4NoJoJQZRP6-ODG4Mlhh8MKCLApMvJzlaEJN2z8T9SAscKxSRsWb_zHAvxtH2n8WvZ8c-eAXA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Tue, 12 Nov 2024 17:40:12 GMT

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 212ms
24ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 7e9d58f1017663a4dc1afe330e6e324f
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 195ms
8ms Script
text/javascript 65.9.66.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-122.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 07:38:20 GMT
content-encoding: gzip
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 80548
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 8Q61CSaS7ujEikJ5O_ncJN0fNXkILZn4alvRZyZKWItXebcbjw56wg==

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 203ms
16ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 42020
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230100-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=okIxDz3tWd2QpPnOh7JdCUBnMlgM7V2ud3mmTWlPvHuK5AiGBPb8oKk9HS5LkgBUxFAnD7s3GCJwjbRuHCzSOO4Jr3Ui8%2B07qtjjKAdAEbhysd2h83ZZWwtMQ0jedg3eRaNu3ou%2FlOcZAZMU%2F70%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 82c8272368bf91ff-FRA

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 11 KB
5 KB 197ms
16ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6cfe89b284e6a2100a86b8d6b0e52b76b85cc62622a40d63e929f328d883a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:13 GMT
server: cloudflare
age: 532825
etag: W/"65401291-2b7d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 82c827235b8abbad-FRA
expires: Thu, 30 Nov 2023 06:00:47 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 172 KB
43 KB 484ms
484ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1377815174196728&correlator=4371593625036136&eid=31079745%2C31079525&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fifs&iu_parts=22181265%3A22632072816%2Csmc_970v_2%2Csmc_300v_4%2Csmc_300v_3%2Csmc_sticky_footer_2%2Csmc_200v_2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=970x250%7C970x90%7C728x250%7C728x90%2C336x280%7C320x100%7C300x250%7C300x100%2C336x280%7C320x100%7C300x250%7C300x100%2C728x90%2C970x90%7C728x90&ifi=2&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1701064847699&lmt=1701064847&adxs=315%2C791%2C1230%2C0%2C315&adys=310%2C1172%2C405%2C2260%2C2028&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C2&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&ref=http%3A%2F%2Fvodafoneidea.ph%2F&vis=1&psz=1600x0%7C417x0%7C339x0%7C1600x2190%7C1600x0&msz=1600x0%7C417x0%7C339x0%7C728x0%7C1600x0&fws=0%2C0%2C0%2C128%2C0&ohw=0%2C0%2C0%2C0%2C0&ga_vid=85971985.1701064846&ga_sid=1701064846&ga_hid=378375595&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRjQ4vb6wDFIAFICCGQSGAoJeWFob28uY29tGNDi9vrAMUgAUgIIZBIZCgp1aWRhcGkuY29tGNDi9vrAMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y0OL2-sAxSABSAghkEhwKDWNyd2RjbnRybC5uZXQY0OL2-sAxSABSAghkEhkKCnB1YmNpZC5vcmcY0OL2-sAxSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGNDi9vrAMUgAUgIIZBIXCghydGJob3VzZRjQ4vb6wDFIAFICCGQSFAoFb3BlbngY0OL2-sAxSABSAghkEhsKDGxpdmVyYW1wLmNvbRjQ4vb6wDFIAFICCGQSHQoObGl2ZWludGVudC5jb20Y0OL2-sAxSABSAghk&dlt=1701064845504&idt=643&ppid=3ce9a34c31b348d980be255f54a18cf5&prev_scp=refresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dadhesion%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue&cust_params=gcRTDTest%3Dtrue%26pbstck_ab_test%3Dtrue%26wvr%3D3%26wie%3Dtop%26cndl%3D1%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D200%26wrap_l%3D1700%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D600%26padpr%3D16%2633acrossId%3Dfalse%26amxId%3Dfalse%26criteo%3Dfalse%26hadronId%3Dfalse%26id5Id%3Dfalse%26identityLink%3Dfalse%26liveIntentId%3Dfalse%26lotamePanoramaId%3Dfalse%26pairId%3Dfalse%26quantcastId%3Dfalse%26sharedId%3Dtrue%26teadsId%3Dfalse%26uid2%3Dfalse%26uids%3Dpubcid%26uids_c%3D1%26waai%3D700%26gc_bucket%3DH%26waae%3D1000%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D1s&adks=3255201572%2C1273629756%2C531472206%2C429498904%2C1356030700&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe589aefa9e40d5690f44e487a160e6d5e1345b1c436a4d73e4f27960587791f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44060
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame DC57 6 KB
3 KB 63ms
14ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:47 GMT
expires: Tue, 26 Nov 2024 06:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cx-overlay.js Show response
tags.qortex.ai/cxo/ 127 KB
43 KB 17ms
17ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/cx-overlay.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-bootstrapper-init
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9fba1b0797e04bb4e94dffcf9068f89e75b4fa5569dc9efcb5aa72275435457b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 17
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ngzuhMMWY6%2FZvvsdUBqAMDcnkZmN%2FKPhBE4GdbyE5lqoxvKNEXKCQB0xvHMEFVF8RsT8YCrjX7nTyv3eHu%2Fe38%2Bxmq%2FnGAbL7DyZBOEOogRkCi%2BS8j%2B0hmzbRjE44N%2FMSaZo2DmVY2%2BhaeYm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c82722de10bbfd-FRA

GET
H2 200 p-fc3a8e1a.system.js Show response
tags.qortex.ai/cxo/ 2 KB
1 KB 15ms
15ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-fc3a8e1a.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d1db393aae713dc1b2db9cbe552ac6b9a1b9452e1ccbcff3fc053e2fef7b9ce7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rLpv5AvaonglRtu0AOpXV2o%2FDLim6GSK11a%2BLJc2xFlDZ8sugg%2BL3Zs%2FZ39YAs0pjaMsbXOFNQTw4Sg%2BMdVRpdH8BoGw50AEobtW%2FLYQ5Y5xkjJcah1dKQuQCgKxONCdeS69Vi1SAY6W%2BxTS"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c827236e9fbbfd-FRA

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
271 B 27ms
8ms Fetch
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

251b922b3ef0b9c63cf06fb35bea72f504028e550da9d647489efcfc9a2d830a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Mon, 27 Nov 2023 06:00:47 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58813/ 2 B
199 B 48ms
10ms XHR
application/json 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&v=1&url=https%3A%2F%2Fsimcast.com%2F

Requested by

Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://simcast.com
content-type: application/json
access-control-allow-credentials: true

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1

85 B
203 B

119ms
118ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 5d4df13c0f6640623e976eec0eafda4afd19fcfabe59790c8178fb5a7875e2b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-R0Wcod6rQpZaIOwQtOQBFjGNyJo"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Mon, 27 Nov 2023 06:00:47 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://simcast.com
location: /esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
329 B 38ms
29ms XHR
application/json 52.215.24.0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.24.0 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-24-0.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: ba8c025246872404076f32922544ccffe2ffd82afebe235b69539bf419d72391

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:47 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.20.73
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 p-31c577a7.system.js Show response
tags.qortex.ai/cxo/ 14 KB
6 KB 20ms
19ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-31c577a7.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a87dab54792ca3697212f10ca3a1504a38c2c6d609612d0e3954824d2726a172

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 31
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hqul4Fh30rxoI1knGY5GL7%2FF9qU8Xye3dWT%2Fm2DJHiWdoN7fJAZcQiBb774xbOrJsxAOaWAzmpT1EM5hrQBwPE7g%2FdIprbQOFNA9kourqBPhEfqdGeWG%2BL9btLFqTyronJXAqkRi4JuvI50n"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c827238ec6bbfd-FRA

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame F3C3 15 KB
6 KB 19ms
17ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=simcast.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:47 GMT
server: Kestrel
server-processing-duration-in-ticks: 332062
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
101 B 94ms
94ms XHR
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002PIxPJAA1&src=esp&ver=1.2.0
Requested by: Host: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ob.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
539 B 52ms
25ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: ae81209337fd7c0bf7cdb30b6ade318c2152a7e4c77340160dfb7a35432ab3b5

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 756d2be176a89a72d8131e8312125312
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
content-length: 265
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 579.json Show response
id5-sync.com/g/v2/ 251 B
528 B 22ms
8ms Fetch
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/579.json

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

b69ee1f17345c91c5a399b8b563c663a10f19f9183123aebc921f1e9d9c3db6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Mon, 27 Nov 2023 06:00:47 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 p-5ce3b907.system.entry.js Show response
tags.qortex.ai/cxo/ 549 KB
127 KB 25ms
25ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e41780e3be523fb5a473724fb211d62f1895023465dd7da82bded927412d2b54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=74VOLozLsmsXoeWoJPqujUXccUvIFnslaIP586D%2BLQmRd1IyydSxnr3GhwBK9WYuFelSm0Ifw7q48JRhwwipmFjf3ydvBmrDdKV%2BA8cU6PvHFRQEf4Ndu0HjN7Qi7ZG2KA89kghwhvppUMR0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c82723bee9bbfd-FRA

GET
H2

200

sid Show response
mug.criteo.com/ Frame F3C3
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=simcast.com&sn=ChromeSyncframe&so=0&topUrl=simcast.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=6_W1Jnw4bzJaNHJ3RndRQ3B3NVZVM3BuVWJUWjNacUZ5amFUdHhGcUFta3VMMGFEdlZPMDFPRXhIMW95TnJuYmlrQityc3VvaHc4MWQ3RUxwNkpLYVZEK2lsU2tydjlpNW1xRDVFdFhOOWdqS0t4Yk1KbVdMQTlXZCtTdH...

431 B
653 B

15ms
14ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=6_W1Jnw4bzJaNHJ3RndRQ3B3NVZVM3BuVWJUWjNacUZ5amFUdHhGcUFta3VMMGFEdlZPMDFPRXhIMW95TnJuYmlrQityc3VvaHc4MWQ3RUxwNkpLYVZEK2lsU2tydjlpNW1xRDVFdFhOOWdqS0t4Yk1KbVdMQTlXZCtTdHh3RU04OUNUblZhMHVnRURnQUlGdkYwU29tSmhJeFMvemlRaTlCN2JQRDlrN0F1U1dCSjgxOFcvZm9RbHI0OTFTVzhiTlVNK2tyVC9SSzRxWXg4NGZKMm54UTRKdkR3Nzg3akxSdDNxa3hYaTNJZEJ1aVA3cmtacjQ0dklONjBPUzd0dDkvZWVpdEM2SUQzbDMwa1RsYnF4Qy9tbTd1UT09fA&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f44b0c312ffbdced05173bf14ac2d506c8df8175a98c70ba65615ae693c266a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:47 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1394302
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:46 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=6_W1Jnw4bzJaNHJ3RndRQ3B3NVZVM3BuVWJUWjNacUZ5amFUdHhGcUFta3VMMGFEdlZPMDFPRXhIMW95TnJuYmlrQityc3VvaHc4MWQ3RUxwNkpLYVZEK2lsU2tydjlpNW1xRDVFdFhOOWdqS0t4Yk1KbVdMQTlXZCtTdHh3RU04OUNUblZhMHVnRURnQUlGdkYwU29tSmhJeFMvemlRaTlCN2JQRDlrN0F1U1dCSjgxOFcvZm9RbHI0OTFTVzhiTlVNK2tyVC9SSzRxWXg4NGZKMm54UTRKdkR3Nzg3akxSdDNxa3hYaTNJZEJ1aVA3cmtacjQ0dklONjBPUzd0dDkvZWVpdEM2SUQzbDMwa1RsYnF4Qy9tbTd1UT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 270974
content-length: 0
expires: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 107ms
107ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c8272409c36931-FRA
date: Mon, 27 Nov 2023 06:00:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CCYpOhNXtyw8ekXRwxCljC5O4SPu35zJ%2Bo1NlyCm7GHjgUiMh3xZLYLHhfTi9dWoTHaoFqMwumKnTHrMNCUxQLO4TaCqHXXT6qmatjgqBZAmfE3bCMMssW828Pi08jMA%2BumeJSa4%2B6o61LU2dbE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
263 B 104ms
104ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KZu2mcY3bwnbS1Y18hX9rY228jFAk8r0DVFSdyxTai0MPb5JubkO4etPZRKXuG8%2BaXANUWXC6PGAMyzOsvU07QICS%2FZ16HVG3zeaXhYkTsGVK%2B8XfsU9%2Bi%2BW8k22LihX0v32WFOzqnkOg%2BleGTM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c82724aa8f6931-FRA
content-length: 0

GET
H2 200 simcast.com Show response
demand.qortex.ai/api/v1/group/configs/stn-12018/ 20 KB
5 KB 211ms
194ms XHR
application/json 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://demand.qortex.ai/api/v1/group/configs/stn-12018/simcast.com
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed7250c0b29056ae9ae8d5d8e3e92bc92d20531effdd5e724ef7e58dcace0080

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BmnfQ7B4lh12%2FEOnvMhlXsI2Vt%2BEpdIKAmEL5gfFn3RTyYAtLhLmoblk3ugJamnvVKuiC4iCNeFIp22U9AD2t5V0vTspxZrFR%2FMjLXc38jmA8fvXhYeDxHYbnM2aap3vkpI15my5wrdgm24o3ic%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cf-ray: 82c8272419dd6931-FRA

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 200ms
200ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c8272409c46931-FRA
date: Mon, 27 Nov 2023 06:00:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JOKQ0XiN%2Fpks4nnDQJBCvDXz8H0L2XNGcARDKLytCALJpgSxlTfM9SCkBKREIKmsFW%2BBMvBAe30H5fv4hylK0m5CGcS7SeOblUDgfYPyXv8j9d97eQIv4kqTjyq%2BYXZNzi6N6zNcDtUJOoU02j4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
265 B 104ms
103ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=snQZbBH3IDeGD4ASU%2Bdv4r6pASO4TjDa8KcTMxuB1CqrmTIIPmmq%2BW4AVnEVmCeWyl%2B%2Boe2nWHkFvEZuldIDn3To%2BtcEFYXCAM%2FNvsJyi1JDlJyW06R13O5TGD9bY6MBB2WZG%2FeZFm0nKuxcOTE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c827254af46931-FRA
content-length: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame A706 0
176 B 37ms
17ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Mon, 27 Nov 2023 06:00:48 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012310301456000/ Frame 7E2F 196 KB
56 KB 31ms
7ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6077711ce3174050ccebe6559eb5f0e251942c2cad21900d1c3ef316065565b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 25 Nov 2023 04:19:00 GMT
age: 178908
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56081
x-xss-protection: 0
server: sffe
etag: "6a17d296884b026a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 24 Nov 2024 04:19:00 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 7E2F 15 KB
5 KB 42ms
19ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53b6ad23b258ce11eed97786741510819a369348afcf1260856fe3041fc33de

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 23 Nov 2023 21:48:00 GMT
age: 288768
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5225
x-xss-protection: 0
server: sffe
etag: "0b7142e00666043e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 22 Nov 2024 21:48:00 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 7E2F 95 KB
29 KB 43ms
20ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3907cc5ed9d4a0cdb316d069614220b55fccd5624ac173592a7a4c2c3aae0636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 25 Nov 2023 01:47:30 GMT
age: 187998
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29077
x-xss-protection: 0
server: sffe
etag: "7b1f1965b6cd6fda"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 24 Nov 2024 01:47:30 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 7E2F 5 KB
2 KB 46ms
23ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

516f5e4c2dc5c69f3e1707e76695f866f8e62468aca15c1a9ddb165eb684f6f0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 24 Nov 2023 22:04:26 GMT
age: 201382
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1911
x-xss-protection: 0
server: sffe
etag: "5b0a82507b260c6e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 23 Nov 2024 22:04:26 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 7E2F 40 KB
13 KB 47ms
24ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ebc36644e10f87e20812c15e329c1b25848c62cd6cdfe74427cdf8995bc3a9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 23 Nov 2023 23:09:32 GMT
age: 283876
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12952
x-xss-protection: 0
server: sffe
etag: "9817e561a46c70fa"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 22 Nov 2024 23:09:32 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 7E2F 4 KB
655 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 05:52:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7E2F 2 KB
2 KB 10ms
9ms Image
image/png 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 45772
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Mon, 27 Nov 2023 17:17:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7E2F 295 B
319 B 8ms
7ms Image
image/png 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 30250
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Mon, 27 Nov 2023 21:36:38 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7E2F 0
0 16ms
15ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRALzCW8f_AVudLtPjiw79sBPi3vE7-Xt7oan7ixiVbhysvFEGLXsne62Ah-rV6XwZNs4gkZktfURpUvhO_jerL3nHs-g
Requested by: Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 container.html Show response
35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0090 6 KB
3 KB 12ms
7ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:47 GMT
expires: Tue, 26 Nov 2024 06:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D9F3 6 KB
3 KB 9ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:47 GMT
expires: Tue, 26 Nov 2024 06:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D472 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:47 GMT
expires: Tue, 26 Nov 2024 06:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 51CF 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:47 GMT
expires: Tue, 26 Nov 2024 06:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 11307089586087921478
tpc.googlesyndication.com/simgad/ Frame 7E2F 100 KB
100 KB 9ms
9ms Image
image/png 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11307089586087921478?w=600&h=314&tw=1&q=75

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0c70c53a38a31f0874449b7fca4fe2fbec29f1f4af9c56a15c80514424a179e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 23:01:16 GMT
x-content-type-options: nosniff
age: 457172
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 102135
x-xss-protection: 0
last-modified: Thu, 16 Nov 2023 08:49:46 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 20 Nov 2024 23:01:16 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/2328432209560610434/ Frame 7E2F 1 KB
1 KB 14ms
13ms Image
image/jpeg 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2328432209560610434/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c26a26cad0fc37eba282302283154844ee751168c8b8f48c514fdbeb593d44ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 14:30:38 GMT
x-content-type-options: nosniff
age: 574210
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1433
x-xss-protection: 0
last-modified: Fri, 18 Nov 2022 12:58:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 19 Nov 2024 14:30:38 GMT

GET
DATA 200
OK truncated
/ Frame 7E2F 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5d57cec95b764af8b1bf0f69e0dd2bce56026e80a2d50ea9b0d8fd74621fabc9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 7E2F 16 KB
16 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 08:19:38 GMT
x-content-type-options: nosniff
age: 164470
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 08:19:38 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 7E2F 15 KB
15 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 13:37:09 GMT
x-content-type-options: nosniff
age: 145419
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 13:37:09 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 71F7 624 B
242 B 49ms
48ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNX_2ZGir0wN-BHPe3BDCYT1solx1RFadFSKYVSG0lT2wdVwRmm6AIOU7m4A4vl8FncEmFENtNmeVA66BgtC40mLiDuga-aw5I1s8v_tb6jZE8QQZLeG716BzSfW_Tq4bXLQRcuKYC3SG80FpvM93-tbj2LIcQT5W8DfFOsaG6pnnA6cHX8Bn6DkMlv4s4x3XTZOQcDm_PhwyO-qXqdKmBqsnFdmwA

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 0090 89 KB
31 KB 83ms
83ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0090 42 B
63 B 47ms
46ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BTqBCSxFYYdlFiSLe1tRn_EDEtMBxztHk0hZh1q284FNnnaUCNYK5jVeta25CxtNvrygXE9cc4D0VXBt1oZfM2Flr8-KE8jJeqiJAsZQGLc4LE85Y

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0090 0
20 B 47ms
46ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=10855745751645035017&x=1&ct=77

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 0090 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71045
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 0090 20 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0090 202 KB
64 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0B23 624 B
242 B 52ms
51ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVdEkoJadibrEJFD2MBN9nFwlTTii1Tv-Hn4AzUbv4TEBEo8XzJghcm8T68OV8ohusYd4iVbqoaJYU5YBuVm7UcexMc2S_0Q8gSCwDltnjkJQRmf7J_kEMYyMfkwXBKvC9AohGFB7oisPTxAhcS0Dx-3qI8O70l4ubXsOy_6DE7ZfyHoK5ee1VTe78KF68Xkwp2CbdKNuRlBxLttqozdBMdxvWgfA

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D9F3 89 KB
31 KB 126ms
126ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D9F3 42 B
63 B 47ms
46ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ArAx-Bm_g1rsgzOwJkqyXkWq82_Pq1I5IUE315D8riMlAIEqZOtxUCsH6_oxJW_fitJSEidZjqNLFQmhTzU8FWhcQEg7lD8QAH2JUuKfE_VGqKtWA

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D9F3 0
20 B 47ms
47ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=13111126243688904814&x=1&ct=77

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame D9F3 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71045
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame D9F3 20 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 16:17:19 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D9F3 0
0 15ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQuWs1ReHNFEm4NeaU318AiqmFcgZdre73o6RgOADJxDmRz1ddXrTkwMpp_xuEyGF9DLqacZ4X9L5moFByNf-dua6Zu6A
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D9F3 202 KB
64 KB 31ms
27ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9756 640 B
262 B 52ms
50ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXm-PWbnqsRTxgwTmnGcIpZYlRy1vKRojin-lnAIPLBa_bXIuaOWegw5qBM2PR3dNqyNSyUjXtJppvyfsaxVHEPExcK6OlaUh-du6t2eVFxxwY72_gmb59XVBTME0kikhrmMC91ao2FzBd9tPe6H-TGmkCOfjkRdOwerDTvjTMLT7HC3qQrLdnCv6vKcfk9HT3R4a0wU1IaY5KXC9SjDOYPcnXa-w

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D472 89 KB
31 KB 128ms
125ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D472 42 B
63 B 48ms
46ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C5JP1DgS9AT8Jsl-9NecHr8DnpuQUP83uQUfwTofyZZe5bGz-Qcg4cL7Ay753WgT31vwtpNFU2OyAA8sq-4V7aSJJ2QvWzPmj-cyW7WBhh85h9fxQ

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D472 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=18306730554864472395&x=1&ct=77

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame D472 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71045
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame D472 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 16:17:19 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D472 0
0 17ms
16ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRf1S9NsM58TOWM1N-t6tm8G3AdoUVfkuEx3BqCj8yZBKc_K07jDwqz9VvACFgwGUhOkeynN_bWlMk_nabJGcif3hpu0w
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D472 202 KB
64 KB 31ms
28ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4CD6 640 B
262 B 50ms
48ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNWY_DO5AvTo6iEBd3BJZtKn5Jhwy2ndpTTAYWwBhscaOmQEaBOUCl4dCRVLMxooaOZDme82Rvxe9gOlKEqYgrefMT8deROc3yipSETn_IN8JOrw3WKVeNgSWWQK92PZt97YafFEV3R45h3ddFtQ0VUaBDIGiPztRm3HEkGMjz7mcWDC1Sp0uArw_w7JxylvQuA6P2PA7OMeLJljIpiVQdVF2wEdRw

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 51CF 92 KB
32 KB 160ms
158ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f40994eab15b92af5183f9acf338e0354771054c65024e0aa679b6506f9eb87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32789
x-xss-protection: 0
server: cafe
etag: 17194431578830737671
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 51CF 42 B
63 B 48ms
46ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CmmMtiVtmYABipbHsnXEe7a-aKK9QA20B0YLYiuV9yqh9f6xDrFjav74ihHWSqrxkOtRSryrFvhfSGVLYUXYBNJo_bw5xd0MDdWvkKTiw7rDqzWPM

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 51CF 0
20 B 46ms
44ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=11199176347821188002&x=1&ct=77

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 51CF 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71045
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 51CF 20 KB
8 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 16:17:19 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 51CF 0
0 16ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTHvJf36vzf6-VM5DIKP-2QGGzi5lGgcfTUBY3BRw3P0JJxz3ZiK3Hn9CUp7ATc9kGAXjbGzm46c6IzuwaJU0zt3g8L3w
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 51CF 202 KB
64 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 27 Nov 2023 06:00:48 GMT

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 111ms
111ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c827260b876931-FRA
date: Mon, 27 Nov 2023 06:00:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y57F0r8ypxAHsaBKuuYeYjewMvypux50zUMqoZUtVy9GksgNbkG8QiGejjLLpTH98wo2JcWbF8687jv2MhJXV1KyPr%2FJWbYQPJJJZ3Ka2pHUN41mVRkJaO6ElwSaD25k%2Fwa6aHRkwzmes4npxcs%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/161089/5500/ 212 KB
64 KB 47ms
9ms Script
application/javascript 23.32.184.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/161089/5500/pwt.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.32.184.192 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-184-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4dcf78b31f69c1674cb5a75cd5fd5744538b50eaf34076396d9cf54acebee6e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
last-modified: Sat, 29 Apr 2023 00:43:34 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=53346
accept-ranges: bytes
content-length: 65407
expires: Mon, 27 Nov 2023 20:49:54 GMT

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
268 B 200ms
200ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jkKk3Hdk2TWbVgusRWZjDr5k2qwmd%2BK3WM3ME2uz57W76Cgu40%2FxviUUN%2FrnyXMH10TRxz32r4RWtnlzhz5VM83E9HYBQP8EW04nEqP1TP%2FPr5sI%2BYIY3M1VcMZR8PWzMrkW%2FNP7VA%2F%2FoNm%2BcEA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c82726bc096931-FRA
content-length: 0

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame FEB9 0
160 B 57ms
15ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=200527&r=https%3A%2F%2Fdemand.qortex.ai%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fsimcast.com%7C%7BUID%7D
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Mon, 27 Nov 2023 06:00:48 GMT
Pragma: no-cache
Server: nginx

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
256 B 114ms
114ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZHWfRzcDZZIeytDTy5zco%2FI6I5p6fpfsR3d64V9pdod4bwepsApb5lpIPaso7h5uq4FmtRzUujS1hNmbUK6zgKCHnr0koZ1QYP6asvKgYdIbjlJ%2FO1wyb6wDoWDgXERWPD5ib6RpsSH%2Baa1gWz4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c82726bc076931-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 102ms
102ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c827261b8f6931-FRA
date: Mon, 27 Nov 2023 06:00:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ntcaMk5KQ%2BEDhsJrR%2FDa5bq1pr37V%2B5yu59AvpwenaHzUGuBBkW6rMwEMQk5Y2l6Jv7ozgIqlT1h%2BePqZ1UMwQVZ4ugtvXtNeVQE6OwaN%2BjT6cH%2FPlp5E4s3Wo1UP%2BiTvqbCKI5azyDa%2FP8sZEA%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7E2F 2 KB
2 KB 12ms
7ms Image
image/png 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 45772
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Mon, 27 Nov 2023 17:17:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7E2F 295 B
319 B 12ms
8ms Image
image/png 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: simcast.com
URL: https://simcast.com/?d=vodafoneidea.ph&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 30250
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Mon, 27 Nov 2023 21:36:38 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 71F7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1

43 B
775 B

20ms
20ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNX_2ZGir0wN-BHPe3BDCYT1solx1RFadFSKYVSG0lT2wdVwRmm6AIOU7m4A4vl8FncEmFENtNmeVA66BgtC40mLiDuga-aw5I1s8v_tb6jZE8QQZLeG716BzSfW_Tq4bXLQRcuKYC3SG80FpvM93-tbj2LIcQT5W8DfFOsaG6pnnA6cHX8Bn6DkMlv4s4x3XTZOQcDm_PhwyO-qXqdKmBqsnFdmwA
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GQM73ra%2FFvwS4l0iPZ%2Bk%2F%2FJa7PpfpV0j0Em1j4gcKdYCb%2FI6l0g%2BEFMGcLuMyybpmTo4y81sXRhrRbItqGuolJyytu1HxW72jbQv6JFzwjEy63rxqlehIZF77PFJMjqXMQP%2BWxPHgRSUmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82c827268a2e3836-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 71F7
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWQwkGPqKMUe6lmGFbU6zwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1

43 B
731 B

22ms
22ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNX_2ZGir0wN-BHPe3BDCYT1solx1RFadFSKYVSG0lT2wdVwRmm6AIOU7m4A4vl8FncEmFENtNmeVA66BgtC40mLiDuga-aw5I1s8v_tb6jZE8QQZLeG716BzSfW_Tq4bXLQRcuKYC3SG80FpvM93-tbj2LIcQT5W8DfFOsaG6pnnA6cHX8Bn6DkMlv4s4x3XTZOQcDm_PhwyO-qXqdKmBqsnFdmwA
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n2Ca4rMRUCwe4G8zoAfnO3YPk7qX2sLZsI2UyNmqpCku4mjh9uhdqOhKg3pot5%2FrYw0MjkJJFPaDLJZRG%2FhK8Ahpk2YEcYEeKGBzST6K2mppJLeUTsDo62xndqp1sRx4RvMetMULvSdxfg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82c82726aa493836-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 71F7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBDfEaIjzAganbMp0fTPN20&google_cver=1

43 B
837 B

14ms
14ms

Image
image/gif

185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBDfEaIjzAganbMp0fTPN20&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNX_2ZGir0wN-BHPe3BDCYT1solx1RFadFSKYVSG0lT2wdVwRmm6AIOU7m4A4vl8FncEmFENtNmeVA66BgtC40mLiDuga-aw5I1s8v_tb6jZE8QQZLeG716BzSfW_Tq4bXLQRcuKYC3SG80FpvM93-tbj2LIcQT5W8DfFOsaG6pnnA6cHX8Bn6DkMlv4s4x3XTZOQcDm_PhwyO-qXqdKmBqsnFdmwA

Protocol

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
an-x-request-uuid: 09ef740c-81e2-46ec-85bd-23aac30736ac
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.40; 81.95.5.40; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBDfEaIjzAganbMp0fTPN20&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 71F7
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzgxNDczMzY0MzE0MzI3MDU1MA%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzgxNDczMzY0MzE0MzI3MDU1MA%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
an-x-request-uuid: 4c46de14-b719-413a-b116-dbaa9053d204
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzgxNDczMzY0MzE0MzI3MDU1MA%3D%3D
x-proxy-origin: 81.95.5.40; 81.95.5.40; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0B23
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1

43 B
734 B

25ms
25ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVdEkoJadibrEJFD2MBN9nFwlTTii1Tv-Hn4AzUbv4TEBEo8XzJghcm8T68OV8ohusYd4iVbqoaJYU5YBuVm7UcexMc2S_0Q8gSCwDltnjkJQRmf7J_kEMYyMfkwXBKvC9AohGFB7oisPTxAhcS0Dx-3qI8O70l4ubXsOy_6DE7ZfyHoK5ee1VTe78KF68Xkwp2CbdKNuRlBxLttqozdBMdxvWgfA
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VAdPB9NuYGf%2FfuY55gWB7N1vCd6rsJPZ4mlU%2FiTCoZOAIB%2BUOHASnAeYPQcgzGLkaPVahfApzWk5Lr%2FlNz0g83cpkQnYahSVUU3BD8gnbrJF3vEawg19OA7CZsuWLsvjm4iveW2OgZrmDA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82c827268a2b3836-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0B23
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWQwkO7IanDqL7c5cx9HfgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1

43 B
734 B

34ms
34ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVdEkoJadibrEJFD2MBN9nFwlTTii1Tv-Hn4AzUbv4TEBEo8XzJghcm8T68OV8ohusYd4iVbqoaJYU5YBuVm7UcexMc2S_0Q8gSCwDltnjkJQRmf7J_kEMYyMfkwXBKvC9AohGFB7oisPTxAhcS0Dx-3qI8O70l4ubXsOy_6DE7ZfyHoK5ee1VTe78KF68Xkwp2CbdKNuRlBxLttqozdBMdxvWgfA
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sVQsbnCp2UkQQvfiqaF%2BvRv3xXwtXtdhBfk5mkUErw%2BHfd1hO16pMony84z657xqmi3m40pnvIKVY%2FbbMNETQ50a7gtdy8cNNQ8y8%2FgDdpo6oAaQgewawVmfM8FJAT77aWCQ%2FxL9rSuJcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82c82726aa4d3836-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGalFSMlw6wtl8ft7jzrJPA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 0B23
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBDfEaIjzAganbMp0fTPN20&google_cver=1

43 B
838 B

15ms
14ms

Image
image/gif

185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBDfEaIjzAganbMp0fTPN20&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVdEkoJadibrEJFD2MBN9nFwlTTii1Tv-Hn4AzUbv4TEBEo8XzJghcm8T68OV8ohusYd4iVbqoaJYU5YBuVm7UcexMc2S_0Q8gSCwDltnjkJQRmf7J_kEMYyMfkwXBKvC9AohGFB7oisPTxAhcS0Dx-3qI8O70l4ubXsOy_6DE7ZfyHoK5ee1VTe78KF68Xkwp2CbdKNuRlBxLttqozdBMdxvWgfA

Protocol

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
an-x-request-uuid: 515731c4-c4b0-4189-b312-efb8a2fe1bac
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.40; 81.95.5.40; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBDfEaIjzAganbMp0fTPN20&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 0B23
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzgxNDczMzY0MzE0MzI3MDU1MA%3D%3D

170 B
243 B

28ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzgxNDczMzY0MzE0MzI3MDU1MA%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
an-x-request-uuid: c79e6e0a-f3f5-4a4b-bcd8-0775de0963f5
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzgxNDczMzY0MzE0MzI3MDU1MA%3D%3D
x-proxy-origin: 81.95.5.40; 81.95.5.40; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 4CD6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH96RPW-ybXw3MXcCoojxwI&google_cver=1

43 B
114 B

19ms
19ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH96RPW-ybXw3MXcCoojxwI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNWY_DO5AvTo6iEBd3BJZtKn5Jhwy2ndpTTAYWwBhscaOmQEaBOUCl4dCRVLMxooaOZDme82Rvxe9gOlKEqYgrefMT8deROc3yipSETn_IN8JOrw3WKVeNgSWWQK92PZt97YafFEV3R45h3ddFtQ0VUaBDIGiPztRm3HEkGMjz7mcWDC1Sp0uArw_w7JxylvQuA6P2PA7OMeLJljIpiVQdVF2wEdRw
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH96RPW-ybXw3MXcCoojxwI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 4CD6 43 B
120 B 37ms
20ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNWY_DO5AvTo6iEBd3BJZtKn5Jhwy2ndpTTAYWwBhscaOmQEaBOUCl4dCRVLMxooaOZDme82Rvxe9gOlKEqYgrefMT8deROc3yipSETn_IN8JOrw3WKVeNgSWWQK92PZt97YafFEV3R45h3ddFtQ0VUaBDIGiPztRm3HEkGMjz7mcWDC1Sp0uArw_w7JxylvQuA6P2PA7OMeLJljIpiVQdVF2wEdRw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 4CD6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEBP-so33npGI4yivURt5mDc&google_cver=1

23 B
163 B

33ms
33ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEBP-so33npGI4yivURt5mDc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNWY_DO5AvTo6iEBd3BJZtKn5Jhwy2ndpTTAYWwBhscaOmQEaBOUCl4dCRVLMxooaOZDme82Rvxe9gOlKEqYgrefMT8deROc3yipSETn_IN8JOrw3WKVeNgSWWQK92PZt97YafFEV3R45h3ddFtQ0VUaBDIGiPztRm3HEkGMjz7mcWDC1Sp0uArw_w7JxylvQuA6P2PA7OMeLJljIpiVQdVF2wEdRw
Protocol: H2
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Mon, 27 Nov 2023 06:00:48 GMT
pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEBP-so33npGI4yivURt5mDc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 4CD6 23 B
163 B 56ms
34ms Image
image/gif 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNWY_DO5AvTo6iEBd3BJZtKn5Jhwy2ndpTTAYWwBhscaOmQEaBOUCl4dCRVLMxooaOZDme82Rvxe9gOlKEqYgrefMT8deROc3yipSETn_IN8JOrw3WKVeNgSWWQK92PZt97YafFEV3R45h3ddFtQ0VUaBDIGiPztRm3HEkGMjz7mcWDC1Sp0uArw_w7JxylvQuA6P2PA7OMeLJljIpiVQdVF2wEdRw
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Mon, 27 Nov 2023 06:00:48 GMT
pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 9756
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH96RPW-ybXw3MXcCoojxwI&google_cver=1

43 B
106 B

20ms
20ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH96RPW-ybXw3MXcCoojxwI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXm-PWbnqsRTxgwTmnGcIpZYlRy1vKRojin-lnAIPLBa_bXIuaOWegw5qBM2PR3dNqyNSyUjXtJppvyfsaxVHEPExcK6OlaUh-du6t2eVFxxwY72_gmb59XVBTME0kikhrmMC91ao2FzBd9tPe6H-TGmkCOfjkRdOwerDTvjTMLT7HC3qQrLdnCv6vKcfk9HT3R4a0wU1IaY5KXC9SjDOYPcnXa-w
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH96RPW-ybXw3MXcCoojxwI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 9756 43 B
219 B 27ms
16ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXm-PWbnqsRTxgwTmnGcIpZYlRy1vKRojin-lnAIPLBa_bXIuaOWegw5qBM2PR3dNqyNSyUjXtJppvyfsaxVHEPExcK6OlaUh-du6t2eVFxxwY72_gmb59XVBTME0kikhrmMC91ao2FzBd9tPe6H-TGmkCOfjkRdOwerDTvjTMLT7HC3qQrLdnCv6vKcfk9HT3R4a0wU1IaY5KXC9SjDOYPcnXa-w
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 9756
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEBP-so33npGI4yivURt5mDc&google_cver=1

23 B
163 B

37ms
36ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEBP-so33npGI4yivURt5mDc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXm-PWbnqsRTxgwTmnGcIpZYlRy1vKRojin-lnAIPLBa_bXIuaOWegw5qBM2PR3dNqyNSyUjXtJppvyfsaxVHEPExcK6OlaUh-du6t2eVFxxwY72_gmb59XVBTME0kikhrmMC91ao2FzBd9tPe6H-TGmkCOfjkRdOwerDTvjTMLT7HC3qQrLdnCv6vKcfk9HT3R4a0wU1IaY5KXC9SjDOYPcnXa-w
Protocol: H2
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Mon, 27 Nov 2023 06:00:48 GMT
pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEBP-so33npGI4yivURt5mDc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 9756 23 B
163 B 54ms
34ms Image
image/gif 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXm-PWbnqsRTxgwTmnGcIpZYlRy1vKRojin-lnAIPLBa_bXIuaOWegw5qBM2PR3dNqyNSyUjXtJppvyfsaxVHEPExcK6OlaUh-du6t2eVFxxwY72_gmb59XVBTME0kikhrmMC91ao2FzBd9tPe6H-TGmkCOfjkRdOwerDTvjTMLT7HC3qQrLdnCv6vKcfk9HT3R4a0wU1IaY5KXC9SjDOYPcnXa-w
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Mon, 27 Nov 2023 06:00:48 GMT
pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7E2F 0
0 51ms
51ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CYO9UjzBkZfS7LvvH7_UPkIWC2A2s3s2gdN7rhY2GEvLs0uCyARABIIb3hiZglYKAgJgHoAHMod_tA8gBCakCB8Q0K5Nasj7gAgCoAwHIAwqqBMcCT9D__bwxtvvzw2wPzxVvNN_nl08um2hRQL3c_hjh3mzY_yyF5BM66E3BELGnVdXTPBO0rIInBmOccAd9A4Wjx24gYQSb7pS-hIYHqwPsgW-fzQj0TxRhpvTHWyJE47Fzr1mdCvXBbBz1vNLkoxYPjHNqbK7sXVNjrBd1QxlWdwPxHbW8l4LCGYzWgIP4Thl9Tm-B1d8BMp6IH0m8X6YbVWbSieDQORiyDL2pHTq2m1ygmUFDhiMRs_VcfeG2E9GCBDVYnLYFuyPMg_k8gAJKgoPeWghc_IhTkBVbui7L4frZHPsNgxwDXYU3PnGZkphPx7x5xbErqKaiy10hQgY0K9PF7xUdeC0Q1Neh4kRuuvb3SKIwDmhcRu7x-yzjNTmeWg9MMhliuOHLL6QlNnI8pXRhW4fi3HuE2n9B49JJ7UuxhX9Eb_HswASj7eTcogTgBAGIBYq8v9RGkgUECAQYAZIFBAgFGASgBi6AB6ep_5UDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQrusS0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOpoJmgFodHRwczovL3N1Y2hlbi5tb2JpbGUuZGUvZmFocnpldWdlL3NlYXJjaC5odG1sP2RhbT0wJmxzdD1wJm9kPXVwJnJlZj1zcnBIZWFkJnNiPWxzciZ2Yz1DYXImaXNTZWFyY2hSZXF1ZXN0PXRydWUmcmVmSWQ9N2VhZWUyYmItOTgzMC02MDJlLTE4ZTYtZmI5YTM1OTUzYjQ2gAoDyAsBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbEC4g0TCIGL9a_A44IDFfvjuwgdkIIA27gT5APYEw2IFATQFQGAFwGyFx4KHAgAEhRwdWItODU4NjI2NTAxMTYyNDEwNxiB1Bw&sigh=kavYC_lt0aQ&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&template_id=484&cbvp=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0090 0
20 B 45ms
45ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6962734939121&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0090 0
20 B 40ms
40ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6962734939121&version=m202309260101&ct=77&x=1&cor=10855745751645034000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0090 20 KB
13 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CU3Qe2Wl0rpibpORj7tZEJ9Shd512MyFMWpJ-LlPS7-Jy4ka6BCWJEdoNJuMqCMY4-swjyzVuBO73ueSaPmsL_oCn3C4kk8dtKsX3faFbOmR1bTzE9i4fPhLuqtG8afEJH9Clfj342uj5FQxp6hTU9iLQLmUTS0UA5arB_15gOPHUjCcY&cry=1&dbm_d=AKAmf-BHEcCfU3bEE-j-3-cE3vuWgkpoXjvSQnwX_QAt5LwEdGRE9he1XZOLaOVpncQdw2gk5NHmkPO2rsQIYX0ZGwkCBwXCyPoGyaykUL3kxe808dI3Bpmrdg66QcEh-WkNVWqgaxJxJEdiI-FRdvzAYyUPP15dcvhUVZyI-4Z0uexGppIVVHeWSY2IX5YgTKIEYiBgjUBiaO3hyE2Qjh4_i5FCq6knwoOa6GvSwJiqeyWJ37adFLyxulbFlv6p6NnTIG86opwFAPwsON5m9VnknaUg5WdJqrIQiDc8lZSUvWVWt8suq9tYQM7sZbnV5tT6OIKLWlpsenwP8MpYiwY9qvuPZb7tNlGo_L_E4xGcsSSzrqBZ9nGHeOLySz_7iVT9ORfTr_RZ5_gC5LcIQ6zdWQ4WJSauD1h1fbNEgN06oYJcYgxGi1dLAtQK95w9mrlVUMGVNkKrsQJwINcLBIUnwmE0sFlgkUaoSWlJHr4flQuIc_Bh_2_SYcd3l6i3o45i--VDTO_gD7X3-5Ockyv5WDHuXKKKDMHmEC8QrArnh6CioLOI7sQ3v75yog-blYQZ-4vmAuDn11A2R000Ly-dzJt0qqlP3o4k-7XWw3_wYKUE70p1A3-Jz66d9JOmLr-4bZyraEAthSStb8osDBaHfijhyJ4wLEQuxPVtxMvpsfny4EzO5X25SJLV9GaDdtY4P4dDaT-lomB0c4ucqRbcST4rdVVFBfyrg4q3If6dv3_IeHs0l3h7TnKvGA7R3kfN9Ddn4zxaGxMAcH-tT6E7PJ7vevUnO7HuP3zXSbGpQzZ6SUP4v58hLW0h7E3m7Alr0XSLQRZpQ0KA8Ck0xeOFIUwF0sgnoag2RhXdNgxt10HADj_001cjO69Tnk6Ddp4b7eZVeJqgp4GS5_kLSzZPOggnYn36h02D6PkyEBs8_BnQyUVHzlNlXuRcFTDuuUNa_c9pJdgpxmouYGIaxhjD1NhJ4q6VhcwehNGszHNSUygctfPoFjbxRYhEOwhBPCPUSBBjJ_jbFQFSGzi39_-xgKKNzRrfCFJcG-Lve1WktztNx-tTqp9uT53UFGC2qjQEwnG_FNLnTrdTjrISTcNrBM1HtFll6cB2o50vDHX9t0Yjb1fAcmMx9ou-JtA6UV7RqOgkou7meiqxsqPVy6p4WSZBtDXoi-l5FnSjwXtD-zijrV01-_n7RmD8IklsO_qgYRxDUxi0wmaAZMEMf_EGD6cSS9lxX3iIyBEwseSpNWtO4bIHKMuErG1bTwVBPPI-j45ATDUTn0p3a33fqx2qTjbLkTfMCaRqMBp_W3fXGGwAm-YOgO2QZhuTUaLkipXDNpkm3jTAYc8lagXrA03LNh-Zp2WDfj0UbCufHQtVkDLqi_iiiL7GO3BJ6VBae7ve8V8BOqbIG_o3HWX65j22tJIWN40PvNv36zTuX2pPOSJxoXQOAVPEOTTemeR0rYucbBSPEvCGvZ-3ahKT0Lw0P9zcLZavS8-BZviW8BRujZV7WcMihDMWVNtGMdOJZYFSlJCViejog1mbC5GjL8k_SOX-h4YBpvEqrvAi2Yp9lEhovUDLEHkCCGOoCPUtRIoTtGtF8CaI8JvIhyxSIHp3_XroN3_qo73z5r2tKU5xUNJoeYgOZ-YpXfi1-G1ifQyxSTQxIE8_jHpRCgu5JNbSYMXVbd8HZPWfR2KXzjBvqCVQkFhkSXIzc0YPWaAB5JZDMVcwQofr7xbbomU1CCnXU9jKLl1L9TD9mOC0Ra8fEVVC4rtRvKVEE0dkZT4Qlb3eYu7YzscW-raKWVww7pK8nAXBdKrr4QuDTJErhXCDznwls2GuASnwdkmnjl4BHmb7fKIa0axtonYYX3bmhgJWe3u7Eusxn8KWXiJaFyjGKBAymVHwA-gqxK8S2odbAgvyS9geJjO9tIZypyy_UKIRPxjHiXvGWf1fxqPjwUpkcjkq76aU9Cpey0n-58EFu0qBC2QvZ4HfTJCYsxGloZzo5S7B2jxLZgX4pkuTqUQoYqVXf8YRQT8UFh5FrqZmkB566E4ICaU-bRfdg8dj0mu44WLQA2SBiQuXDPrE_ER3cbmeR5SeL49uBnwZQfIOMiVe4qFru-ImpcRsAHkrwDNN-Mo6Mvo4OkSWmKHLPx8v5T4TWmY6yNH5s5EBnDQzxOgZ4S55Z94LuDuSM7JBcNT5xPRA4QtkTcXU9arMW9a_Ah4bE3ap9z4DSA8vZVAkB4c2-vSxyRYoYeO5Lt0AK63vk5xojW7BjRifqdXzjIHwiHjVysUiXGpaHuA1snanb7QWb68LrFzcavkkBpkWg3bxs4PVzJ3NziUfQI-494A2xZ2Fn9yS8upkVDenbt1Fzs7tSBNuDbGgQ6BnDCxniE7T7W7aRMSNuqS8UzkzKnnzSRxyo9T6l2X-6vKe_kHLn_acX4_xScNrai9kHhT3gJh94CL3afT4KDhRvp6q5xzgcJ6UFCD0Eex58-3GPywRjUNK3AbNVoUQnpP1ybAZnOCqg25M51F1qYq-1dy-8RcjDT8-34VFjL4iATgleoYrOcwLKih2KWi6DYSMTPh7to9aX6L5wjE8ouFqkeNoIiW7RoV69kBaJ6vBgjT-q3WCIlCQI31y4aZwZiEDMS1q2COep87ymrmZjnE-2UdJffpaQm8Y5Z29740OuaiwXwU7GP84W_FRjVmjGh0bZpXi7rdRsxb_wRtp1bdwb8r2rpmlUwEhNtg4xFn5XDWJxy_HbLFtkSob0YUQohaqlaO6QnZV2rz7lkz6ioWUGtu8kvX2uamRina49AxX69DweNQHgW6TQwS2fYTzpFnMhhrddzAKXGmBMF6znvaHXUk21g18KBFck9RrwzyRdGdYZTxgFGSbrql1Pv3wW6SK6zJa4giJPJ81djnLZ7A_ZJKjcm9PyKBw2gT4M8xVNW2FpBxzWmzmMX1oJOZE7k2q-0YsWcuGVuDUI4aVmYBXXsenZJ3Iz9QIrsBDVWChh05kQwUxeaiSFXQ84Kpo31LsSiBBOf5c1UIEWAtmyRNGWvLPcrLrzuFYDcLPhMcYNZECCkS4Wj2PQKHnAHLx2VkL3qsUOs-1L2oQs6HTDSg1FHMS1zeG_YVXBt8mS-gODplBswB7zIVLTr8fYs3B-2S5NUrSRgGrIN9J1GzkvYrJeA9qpwpjOcQecIktjJJohaPaS7WTXM9vzUsFjmE5bMZ2PqtKfMZ5L4JdB1MoKb6YwdMhW7CzzodUu80L7v5V4L01cwB26wJHateJyxZi2WOCfbaNGF0v0ZO59tEK0EpdBsouBkHQgQdHcdIbnqm_o4O4xtNsepp7bW5siibLsvzDDuwBxRo3d30ID6q_5ZPf2q2BuBowC6eS8Bfk_pbKYshHw8Da0BAWHw6S54LyQdXNcLr9ej_D57Zf-ArwxQg5-WLC33JfMOX4_zeVat4x_KJWxl74aZs4Wds1diTCP_xFV1p61U0ulUJQSNB0BlZs-8PBxp3a9nrmh1ZBQLSeLuvUHXF6qiCpIJiRMpfbGVFjaws4vSH5EEgfm2mVqBWLMv_6784OJ9A9KDdxC_Pm2KqRcSk8ylcyiPxoBB0Ijw6yoFPTUaI6O204p5slCD25VUUm5bsCF55m7EtpAo45VGgCBiFEI8RHFmtvrKKGiXgeEKuehFv0lV8xsKfe-GxT7hkY9Ir6kcNosdRhzp0pooElm9o0EynN9OXYd9TOSzGBQLyfGVzkrgkpseRuxe_EO6gw4jjjHuGJPeerj491BVeSwSyLF1GBDOsUHw2lmx_xsSTMGp5GIvEUrt-L5Q3tQy5uNrnA5HpFenReIzrhnxEm0Owy72_iZYSCB4BwOzl6bxX0PAMU29YdGxuAUiwq1JcCLW8QLBjTYW9-vG9QVUitZzIN0QsPy851KLPh1D3PeT1CaSXECsXVTbWONxhb0w-hEpffn4gx0pF8IIg31AKAvDf5ZgeAnFIhyAyj7mv3T0ecieZ-Ob3Brp_uvMM84ZH64MJSjUAYkVF6uyKFOpSR3oJ4zhislr3o_Qi0dhRr9P3Dwq9SYzpiBtCnjQ3pG5JY444KZaGqkSc35-E&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=10855745751645034000&adk=943508955&idt=89&cac=0&dtd=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21e938c14a07e62b3853592dbac43e834b9b82a806af46e3a3b07d57534b4dff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13742
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D9F3 0
20 B 46ms
46ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1934263553757&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D9F3 0
20 B 45ms
45ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1934263553757&version=m202309260101&ct=77&x=1&cor=13111126243688905000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D9F3 20 KB
14 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DAVeU8tgi8u2WS353ES80nkxBuZUav4VMA_WYEBXxKn9TRczc4n1-jj83cehV8rF5jUMDDp8F8Yq_xBuYK9Pw-YWe2t7-CdRGdJhOwiBGZFCLTeNL_U-Ox5QJRm9hMpy5vsEwqjASqx8LP75bnCV2sOe69sOudjIfKlIbBwCKTy0Hq--E&cry=1&dbm_d=AKAmf-BOfT0ArtR10L1uWEip8ufJM6MsfHcsDNb88N0_y92hU3Tf-LRJK-TJLEDW2esABaNCqDyTqucTiNIZbbEHXSy_nGNx_UV919JloVslWlB0_nQZwnve1lSfe2BEKNdzpk8KPnBUL8UTeFjub5FCigB-A-XTamk4m2iRcxXTylpmKJ23M4ZgB0au777okf01IopB5FKqQdF2LPFR712dcvDFLLZDcD-UA-QShQoYQu10WxVcAm5kaXc9AVhy3VkKP6x32xNckZ8iBEnVlepZ6zjx-LLqzCk4w5pAg5edgftlpcyGuBcqMGlkJ_PtWtMjVDPu5AIklLu9k0sPPkfUDybI-zfIKIxQT6SDKAnu2cp2khw6xW3SVqo-P_IGMMhU8m-meF_r3xQfk2QcfY23aVzAlpCnJAH4u-RgJAQTV7RdPw8yhL4NGdXXZ9_RoshGqHigyvCsasDIcqR9_ZUEmXvKmJlRcBU240a0wBSSAIchArNPFGMhckE24J80b_IHKLf4Z4WSGh88E9YlqIhsEyouXRlBzoHoL638PY4qoPeKRfqltI_zmhnjLjWvujy3eAa1nQpbGaEFLR28PwTuD8wSuJu-CKc5oiMASw_TlBLWagIun3fQxxjgKhAhaVStVnhFpWmKKCAPZveC_wcJjAyGPdcLqCIh5Ik-mh3fuds7GffgngbEv5aWKvqBhJLClm6cYsAjt16PCzSM_Kpx706HRjjx02jFe7wwREEwlNL7ZP7b-V9-QWbRxTdJa7X3v_IoLjp57UwsLd3ciax29vDv1xPxgnMQ4rmuswXO-81-oE0lb-UVlPZptAT5m62vvfvew9ZsIWJGoGUDaTGdT9RJLmAG-T9qguYHM9u4VdVmQ4MKy1IaDb4VqH9nXBnPhYvn7TIz9vlKCPDFQrbQw1tveS5sn8I_6zvDwQ2b6CssN4My5fBOX2W8I7G2qHuKB8l1ocZTPlf8mtxB1sR7hky-9itzrW6b3ImYXA9P9UgTBXKpd_HnqSjhbTPeWGZeI3gAkRAmrDzTiAL_L64aTAn2lVmLjDtfPq3Zb7jQ10HxiRcGd0bdaqZkGsUdbKcRjZuIkM0QrYkN7NomAx0lrZ_XxjIabgmPMf2GexKzZCgf7nRtfi9yhjiyAF5DyCTuz8y9ycqaQtUHf1lSZGKUQ5Aq614sqVmA2ZUvsTLzD-EaKg1EFd0Eoas5sxlwe8DTvsCBO6E2DNw_ZgaCcRdcqI_DWRiukP-v8Ego3P9rblHgYTZ9hPiAU0Og3w15QrcMj4gz13L_B--DZitdyZDyJLPN1OQDGs5DeLUR-WabNAAkKvVJJ2Ycyl5xOfh5mh88R69kF5xK7Kqsc3cFiuv9KZ79RUXMNQClBJIfz3wjLqlRNiqvsrnLqlI9Ctdfb0WMn02edfdJnt4V2EjtAH97BQSoMQFiOSji42uZzHPS2jZSVmlgnMsaWeMpCc0uNEw3n9RKNSVfK6pUPU54lfrWa74RQlmEwxwAb0FPC0cJ-lTiZ2eZNskGQzR69KrOHKtqI-KsCSbYDYLF8vq-GXNlYnWxHmc5_7TNndOLKRpK7pzTf9V0frGCapZCL-7p8AtICiEmdEtNI7_NyrQ-DrSR-ceIb1ZHN88H3xQAjA7B0gmryJ6wxhMrjIws2AYGOQvCprKAPCq5kMoa_FiDtNBUz24lwFsYCHoTnYVGBcE6FBw79h-WrsblD43RK4Bz4EFEDkKV0hQq2v8aC-cH1Xl0N9a_jkJWrMh4AarZIKO3ZpwrW4jbDMFK9qPYq10X-bBx_1YZaUO07Tg2uX1Ky5Cefru_J0DtsLmgAkAYxPSi4P5j1nCzygzfKlsb3M63_UyFNHjGMh9kd8Ec9l7t_BW_TBklnIwRh1nwI3ctGZC0UQSo7bSjTs9GRq-O2-feMbV77YfLT8SrZXSpXoQhIJSif6lhocrnTEO_g-U1OUtBaWVgn5lgqmOAZDEiyzghMe38KOuUv0pJtyb4Kp9pJ-KzmhSlBGFAAXj9Pen7MRNS0FgQDzjGllvYclyvlgsG7Y77ljn2WCw0xDhkNGiinTPW2JYrakn73RaeFPSKDYTKx6dlfIgBRpmdem_Ro6nyK2gCoqTTk_mjFO1U0_oriLUXU3NQdW4iExh1a-RD2nA0vAHrExfzxWVw_e4X7FDpBwe6AtXQrtryD_W6mK6v3yeed1F0yfQz3NyYLlSbCJAJqfXcvKgWaG8GfGLt1uZyz2NBXrFExQgEpd4DnumKgYqqdQyBXKtc8bA2szIeHZm-Oeoz5z7bP73ZEDFyhf6B4cixt91S9Hj2Xh8eUU_nh2o8I0QksoaNgiypfxOooL7peyF8rrKdX-YMHwgXwLEd3I-mW1iGJZD_Lxs6vX9uXhEu6giND3csAno4_QtKZqitKGpBEbGW3can-pm43_r-OOjQu6QT65BAc381jh0QUKPSOYl1TGczlRvGUcZmDmPWS3nPPN1P1bmd9tkEVJQ0NHv4Pls8QJ9Ry_lIUbsKBY7DG3AtchQUFccXNVjDKB-IhCWK0rJgGfrBO3s8H90AbKMlk1hLT-WTz3Sy2z16NJqv77msXfPOSWx9lHFzh-w1dssVP0YwC8E0qn-uUOvkN5PBT-jNVA8ZsO0f70dEiMrl3uiMOgzw4M9ufxavZoWgLUilmGQraxVGfWpiv65QNc2BGc7eqRvM7OtkNB39wI9CPL_eOAAE9qJuyibFGizBjBqSvsN35Il25SHfIuHoDkcmy3ZdovpFhBfVP19q17VpUNmsxswi5pvHqMWjmJ_OGG8q5R0tyWEr5_PoD_QeNMfqwCq0QKCj8dZPG5OmtLKp8eAwV6x7VfKKLSsop5QzgXJL_hybes5B7yAaBWIasG98oMIfvjp9fspqPlkzgGJgmPKiuPOzwKISu6RAZT6l223KVDq1lXcCtcdNqcucnyTwdviuVl6SsupfNZUPlmpY6LqwgGy5_5cckEef04R5UUWKh6ALpQb7Iz21gruzeBEIpQKgrPRFyRnovVo9uhek5UJKXJGYFgUR9TIofzyTvnf5GBL55OhJG99BokJlz9itbcK8RAqb4Jjcf_pcXnhlGgvG1q9UNG9FWfm_AAsEPMIWtM7WObqPUS0zKghkhuTyRZigmT-yWE-dH5mOwL9i3FkKkCi52Bi-vqbxuxpFSugu-XM4Bz_H_aCoWH4LrmRd1rVo2r57zkm17mMTiysjcAw5YnRhsunJcgzzvYxHUhrSnuxan51BUFhQiou_VJoT_W6htW7XmeJGm6lyn-fsMQSDo7q35Zl7BJ6XlQp0Vxu5EMJuaD3hoLVn6BdEoTEIayIT-mU93myiMfi98edXBxuiyO2pbuMkq24X5yOOzlbueWLC5nSSLCZseeb2iNrcPl63fUIUtl8QrSUwq1N1HOM3dyTecuFrWhNsOMD21rrtolYHHjQLQeyRyL6QmblQ2KalWjIBhrAAU44CedqdUyVkDp6uKDqeZCdlHS2OVEVxZCvOKqf7AmE5NlvV3Sk_0CGTdWeuXaU1-JeW-SkOKJbhdyondDpu0nWjp-vc1vsxYg6wJZf5AREhG0YCyoB79ntzTA6rqKr6IC5FMKyD2_4r0aNHwdidjB_GBa5Jjz48TKEugViMjIrgy_tSc7G-0pm5WfCH8-Kbbz9DXcIQdNNu2HGLOp9gXDrMToV3HIuBAoRm9lbK0SnEG_tHXh46DCzVznBaKrB_bBXnmjMGrVYtjuJF2mAmZZb2siRP-_pcBT1Ug0NwfUOQpyG4WmAIzjkt2b7d3qPd9Tr2an_JZz8SOebXFFmtFw9dNTR1YUr9RC3IjMdxpj-Lq9xMFRHAa1w-ivB49G7wdxEoXbf3XGMC6-vTe7qdiEMKZn1EQjH3NbozNujOVEbISXpe6VdSaJAaVyaZf8rs17zatcyknF7vp7gUV8jmc4rK0IqRZEqY7WHvhVKN5BVq2HtnzHHrHRFOTGEhJYXSHHcmENC2SbHVLlwHq-7CiFbj5QNWrFyia9b9IC_PaWLehdZhzKi8ne7V48oUi1feF89Mevi0Z1461QzEBUbzRQ70wtT-C-K8SvpqHP8&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=13111126243688905000&adk=3690638929&idt=132&cac=0&dtd=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7acb3c6f06b1515580bfaf313ebb6689342e1acf61d68b19e0ec6f5e1a0b038a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13874
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D472 0
20 B 45ms
45ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4972230793274&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D472 0
20 B 44ms
44ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4972230793274&version=m202309260101&ct=77&x=1&cor=18306730554864472000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D472 20 KB
14 KB 65ms
65ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C4vfQSLn2ffvukyXMMfHZTZJv8bq6o8e2x24eeNiwCkNLPluJErv1bKnph7Q8CZvrnBDAnfLiuiAlXl4v47ExeN4ltWInJMwgNsniEHgpTHBZajax-BsqVDplJFgahYXjVWmRdZtPcfiAIAX5_Ac-e-eeb44DlYVyKFXGrOHOTWR4vu08&cry=1&dbm_d=AKAmf-BrB_1DfCJ9W-kl-xJs0P2uvJta8Z9yXXJtaKql8SNMvfDxe5wCsYd9nxRExq3QupD1wvJzLf0T76_-F1-1AQRgT8vieMbI9J7q0E0veL4_28PUVLwMfVerPpAJxcIyZ_mlQCz_8OgJpKQOLkMhB9Q8R55y0rS5cKrmF_DXEs8DN-PMH459x6Yg_CqQpu84U0SCRWIPMJDSTJOm-4kOErVImi66POdEE1yOKjUEv1j2piSu98qUzOLItElRuyamfEFKLXT4figCt-YeTSZflSOEQO0XL9z87yG6XFVIZbbETSashShyh7HXJy0QUXrcUY8Gp6aeHLqsVokZimb3gcD0smu7InPDVYZxqITNPTCMkBqfiL-O5hz3OzyJyFf8K1NZ4pafjVLSt4WA1vMGU6fkeB_LeLTsXPsEdKqAyGM_LGOJeVEOHjb2i9Y-YUxjd6PPjZyGltt02NhfrPdfG1jl-CNoLQsZ4dK7Dg9ybZD4kmSr-XHEi_uCOMPhov49Fx1j32sf0kJP8bqatDi9rUherHZeZPQFvgvn1aVtXuCedDoh3Pdhdj5PIaVm072JVh4a9dgyVg6OqSBsz0s87Xh1PRo2XzuzXc0wC3DASOHDyVtuvVXQ9UQ6SlRqEp8sBQERq45MpRWhFViAj86L813I4j_ED7eq86AFS70rGioxdI5it3c0S4GvLcMQP24_H0pmWh_MfNCtq939FNvqW0izwRJP8qQaVXF5AkAOVroSsk9yK_IkP_42hvMYeOGspjqU4eJQGkR6hPwDQXllVnBHK9U9CRzHGyts99v7INIZvopTdt5P9fWGIlHhQ8vl3HHOPu7De4k_4mOTaY9zdoquimaOZQX1OsnnKJHmj0t2l31TeSM8cFMBmjK5_9NaN7O21_6l8wlX8DJAXWAkoI66LN6f18Tx4iRe5K98u4ASz8heiuA2wHJV0ZixWe3mfnRJfXq-I1t_C_HuNOZAjtstfC32VJ3oJ4rQqZ5uh6t08kbWoCjpaiAs50pgO-nMgOUYZQIL_UGFAFNacq4DJR_xtotgvUrWRENFojvqAjLX4w01W6qyn8Cl7Q70CUsz1AmQ1ACoToCKRScIoarJC4W0SWN_Cx_vHmlGPg1-CNsipN2Mi73zBFr8tv-8ommX-n7MxZIuJjILrzMdjWn_9P0kDzG9wpNqL88l4yXV0lHqELfgqbqNHArZpe1beBb_IhC_fmM7P0rbcFA1g31a8tbP3FXX8qh_qG_pjLnlhjMgkr-GI4HidlNqb1c0OQ5j34CVmMron-Z6qzofjBvB3fy7i9MU_g6aYH1SFy5ln1_ixWO5vadzs7KHaJLzgjdhZxjHzgWnWp93eRM7PfOQ5gJK1XquNhDaqeQv8p_KLl-9zh73JEBwJ0aNBHZFXWPwDSTTGvXfybbTKSnjElNKiEFu1rX_3-17L7wSwb8Nbpo0Rdjg6NzW7j9bbDgxclZafmVJza26xfPLT3fWaFFSUqYnBsvs4kHxnGnVpxI17ke8f8uGHC1L5escDlavFAAWKWwUC5TbsQl7Whun8nCxtdwoukBLAqu5n3v2i5Y384K2diWNa1-zKR_BZC1_7HY2pKoWUyYcoN6fvxO0oDr_-JPWENj8-k7JLT4ZhCGcCHULkxSIeY9L3ei6Gky8f8ORuiAB02P-aPfInE1OUdC4d5tw2FAW0F0TQoZbN67ggrm9mOX7JkdzLiuPqEufY4hGq7M5VuDWP50pKGA1fT2j1hJUAp1A9EoptdoXHBGdM7dNxMdv7s4FflloI4xveEoELJC3I9ASc7OnnFg9YRqZrplSxbCi9L1Zvb6rGXLnFG1U513qPkkWOrFaiwbzC4gYO7_5qvAy0KnNFjXlgI43BRtZeA3sGoEveZ93ghKL02uC-iqctCCL5j-h9_e-xgs_37cGtD0CVZwmj6JZE5vaxZtNNDMiwFS8QqpWal4PpR8lqFm7A3PPUP9oL5Z73nx-OdihYuXPlpAoapP-QtUECfSICqhMPor8KKItGDWZqQ57RARf2G6CHybq3-fiy0gy3AiLZiVRj9dECxgLpQCxKwjtCaHS8jqW6YsRDhmUUA9v6G_f4krtKCRstwc7QwIu7nARG9jcQw7OviBQkiibN43GXKi_TQZkDjzvo1uD9qyXVZF6O9N4sJBTcKhjuXhBqExzER2_I4PJlu55J1Ocvo9ii6hpKpoprxapTzv77p2630kOpJsq0cOEQlzJCNmWLGVCML12S1PAwkFr8Z_YXjxi8QBJmXIDtABrlyUbXoumYt8vjv7IJrQVIRDQj2r-0EoCqoQBx1NtrMHsHziT8FTMuThkPgwX4sXNL1vuseIRJBRvSqvuSj8V5ItBLZMFW7HXyt4AAR5NSISiOci20mNLzfIuqNJ-Ys0QT9cxCNt8BVnYKerFDpzaEemgRKipg4dlbgeES8bbYOtr4A8CKgDUnFYOAt2kpuNiZbfN5_ClZxV1rLxDyegOUOThMNl9YRuTjNKfB8kJx5wjFY2n6jZTGaNWkikRJViFZ31lM8SBdPWEGOmhwJQN9SuF7F1MGD2CYi2d7munIxA35-7tN7Y4_57FQSud4ePQ7zTCsADS0ikKGzdsifMfdbBfKn2-w26iTuZKMppSdpyim5qVkEUE3aHfUtHtcRSvo3q7F7kPcwZztANOp-WZYK4VXXQKpCi-7NEYXxwrJJ7pVvecrH1tLKtSdeavBckobuA_yVGxBMhdfzvpRbOWSWQSjzB2ttktR9tbyQy32mPFE9p8gjpSv39Qr4vMZi7ckCh5LdPLEYlTaozkiZoXWYPI3Tp9f2JkS0mqWyDi4C6PiQ3RIqE5NZ0u1oR-aV2QtIG_Fy0E3uV8Luiasu9KBYC0vlCItzrrDXLl516worXQ0XFpiXhbiRw1pptLMDeGx9C_yDYcwK_D0nFsK_ZyQwiO2qVsN5lppnIuE-S35ZGDyKRy2WrCd07X23AKz33ib48fGtSYr2F0yTD6HMc659HJJI1uLZC59IIzfd7lbicsJV_O1U8uuGaqCDUDSjQjXgaU01-z7_cA3N464rLMW17aHctPa56GVxTCxuUuQF7mhgUpfRbhpS35D6nFRXuP07uDG2fzr_S8XRkxn6jopExH82JGPBVH1j6XyLnrirJ_nIkuKjBlKqg6NMi0yx7Bp6otQPEhvAkqbW_VdPl5-AhgoAio26U_89Us3D9yRqf8CEIx6GXC8UdcDAMLCLd_suA-i0fD-CqZBgiI--gwPVwYGuRpU0oBrDEkuUPDn_a56X63A57t8dQZA0m84bCk58qUBS-obxMI8lHd9pCzQeCfPpfZVEwwAxHAkm7goqS0-5pwdAO_bsGYflUzFvvT3U8crig0DmUMgZjG95hH5ql4H8Hix3IXJZWApopzAk7wOzmaZ2gFzXc9608C01_SdC4kBX460rU0F-4eBENhPxt1GMtbH9eTVhRMr2YS6BGVhmjWhmoEJpwK4CRzgwyrGp5IwEr9Zpg5BWNnztX44hvRbtZ_31zD96mgPyLFVHbAR64o2Dcj9yxq1B3VsnMfjM4-GoDENjIjhECTTl1ZmZFo9_qrwvRZXm4AGsf604PVnNY2-u_pcnhPAi2i_70fbKhAx4AFyp7K6MtSYZke-rCNJ81HRLIepnMOZbTDy936WrAOwOPstLrWus9uNN4oUGF3I5qhzBPLdnl4DOO3qNXEpGmERDUiPpH-Jcq9vckyCBJzc1I8ULschVMl1fZJjHzB6aDponTEe6OTDcFMnMi5j_tasRimjO1Eb723Z1H2rBlvMB3Pspbgkd9tDftbER710TK_pobuHCrRACwjYMdMXcyW0hPdzaTrx2Lb-72VadENMx4lPRPtrqVvCbVPkckcr0TqqqPJ8tX_vfazU_APmcAITO5UjRFhIh3IlxrG4bmCXX7KsoM_ksPEf0n1sK4k-qaHhjqJZ5Cv_wsJR0chfs4wZiABT4XCYBsb3ZlJEeEgHIE5mV7YrGpTTBDrvUDiVEPMuKKzuTzVOaX9nB3Pljc1DiXGuoaeYC59kiPJevLqi2QTi4nTiw&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=18306730554864472000&adk=1033480531&idt=134&cac=0&dtd=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6149703d449ae5f5ff42028c004e911b3a06cc08d25fd08c78f7bb1c7f7b7dab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13949
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 0090 41 KB
14 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CU3Qe2Wl0rpibpORj7tZEJ9Shd512MyFMWpJ-LlPS7-Jy4ka6BCWJEdoNJuMqCMY4-swjyzVuBO73ueSaPmsL_oCn3C4kk8dtKsX3faFbOmR1bTzE9i4fPhLuqtG8afEJH9Clfj342uj5FQxp6hTU9iLQLmUTS0UA5arB_15gOPHUjCcY&cry=1&dbm_d=AKAmf-BHEcCfU3bEE-j-3-cE3vuWgkpoXjvSQnwX_QAt5LwEdGRE9he1XZOLaOVpncQdw2gk5NHmkPO2rsQIYX0ZGwkCBwXCyPoGyaykUL3kxe808dI3Bpmrdg66QcEh-WkNVWqgaxJxJEdiI-FRdvzAYyUPP15dcvhUVZyI-4Z0uexGppIVVHeWSY2IX5YgTKIEYiBgjUBiaO3hyE2Qjh4_i5FCq6knwoOa6GvSwJiqeyWJ37adFLyxulbFlv6p6NnTIG86opwFAPwsON5m9VnknaUg5WdJqrIQiDc8lZSUvWVWt8suq9tYQM7sZbnV5tT6OIKLWlpsenwP8MpYiwY9qvuPZb7tNlGo_L_E4xGcsSSzrqBZ9nGHeOLySz_7iVT9ORfTr_RZ5_gC5LcIQ6zdWQ4WJSauD1h1fbNEgN06oYJcYgxGi1dLAtQK95w9mrlVUMGVNkKrsQJwINcLBIUnwmE0sFlgkUaoSWlJHr4flQuIc_Bh_2_SYcd3l6i3o45i--VDTO_gD7X3-5Ockyv5WDHuXKKKDMHmEC8QrArnh6CioLOI7sQ3v75yog-blYQZ-4vmAuDn11A2R000Ly-dzJt0qqlP3o4k-7XWw3_wYKUE70p1A3-Jz66d9JOmLr-4bZyraEAthSStb8osDBaHfijhyJ4wLEQuxPVtxMvpsfny4EzO5X25SJLV9GaDdtY4P4dDaT-lomB0c4ucqRbcST4rdVVFBfyrg4q3If6dv3_IeHs0l3h7TnKvGA7R3kfN9Ddn4zxaGxMAcH-tT6E7PJ7vevUnO7HuP3zXSbGpQzZ6SUP4v58hLW0h7E3m7Alr0XSLQRZpQ0KA8Ck0xeOFIUwF0sgnoag2RhXdNgxt10HADj_001cjO69Tnk6Ddp4b7eZVeJqgp4GS5_kLSzZPOggnYn36h02D6PkyEBs8_BnQyUVHzlNlXuRcFTDuuUNa_c9pJdgpxmouYGIaxhjD1NhJ4q6VhcwehNGszHNSUygctfPoFjbxRYhEOwhBPCPUSBBjJ_jbFQFSGzi39_-xgKKNzRrfCFJcG-Lve1WktztNx-tTqp9uT53UFGC2qjQEwnG_FNLnTrdTjrISTcNrBM1HtFll6cB2o50vDHX9t0Yjb1fAcmMx9ou-JtA6UV7RqOgkou7meiqxsqPVy6p4WSZBtDXoi-l5FnSjwXtD-zijrV01-_n7RmD8IklsO_qgYRxDUxi0wmaAZMEMf_EGD6cSS9lxX3iIyBEwseSpNWtO4bIHKMuErG1bTwVBPPI-j45ATDUTn0p3a33fqx2qTjbLkTfMCaRqMBp_W3fXGGwAm-YOgO2QZhuTUaLkipXDNpkm3jTAYc8lagXrA03LNh-Zp2WDfj0UbCufHQtVkDLqi_iiiL7GO3BJ6VBae7ve8V8BOqbIG_o3HWX65j22tJIWN40PvNv36zTuX2pPOSJxoXQOAVPEOTTemeR0rYucbBSPEvCGvZ-3ahKT0Lw0P9zcLZavS8-BZviW8BRujZV7WcMihDMWVNtGMdOJZYFSlJCViejog1mbC5GjL8k_SOX-h4YBpvEqrvAi2Yp9lEhovUDLEHkCCGOoCPUtRIoTtGtF8CaI8JvIhyxSIHp3_XroN3_qo73z5r2tKU5xUNJoeYgOZ-YpXfi1-G1ifQyxSTQxIE8_jHpRCgu5JNbSYMXVbd8HZPWfR2KXzjBvqCVQkFhkSXIzc0YPWaAB5JZDMVcwQofr7xbbomU1CCnXU9jKLl1L9TD9mOC0Ra8fEVVC4rtRvKVEE0dkZT4Qlb3eYu7YzscW-raKWVww7pK8nAXBdKrr4QuDTJErhXCDznwls2GuASnwdkmnjl4BHmb7fKIa0axtonYYX3bmhgJWe3u7Eusxn8KWXiJaFyjGKBAymVHwA-gqxK8S2odbAgvyS9geJjO9tIZypyy_UKIRPxjHiXvGWf1fxqPjwUpkcjkq76aU9Cpey0n-58EFu0qBC2QvZ4HfTJCYsxGloZzo5S7B2jxLZgX4pkuTqUQoYqVXf8YRQT8UFh5FrqZmkB566E4ICaU-bRfdg8dj0mu44WLQA2SBiQuXDPrE_ER3cbmeR5SeL49uBnwZQfIOMiVe4qFru-ImpcRsAHkrwDNN-Mo6Mvo4OkSWmKHLPx8v5T4TWmY6yNH5s5EBnDQzxOgZ4S55Z94LuDuSM7JBcNT5xPRA4QtkTcXU9arMW9a_Ah4bE3ap9z4DSA8vZVAkB4c2-vSxyRYoYeO5Lt0AK63vk5xojW7BjRifqdXzjIHwiHjVysUiXGpaHuA1snanb7QWb68LrFzcavkkBpkWg3bxs4PVzJ3NziUfQI-494A2xZ2Fn9yS8upkVDenbt1Fzs7tSBNuDbGgQ6BnDCxniE7T7W7aRMSNuqS8UzkzKnnzSRxyo9T6l2X-6vKe_kHLn_acX4_xScNrai9kHhT3gJh94CL3afT4KDhRvp6q5xzgcJ6UFCD0Eex58-3GPywRjUNK3AbNVoUQnpP1ybAZnOCqg25M51F1qYq-1dy-8RcjDT8-34VFjL4iATgleoYrOcwLKih2KWi6DYSMTPh7to9aX6L5wjE8ouFqkeNoIiW7RoV69kBaJ6vBgjT-q3WCIlCQI31y4aZwZiEDMS1q2COep87ymrmZjnE-2UdJffpaQm8Y5Z29740OuaiwXwU7GP84W_FRjVmjGh0bZpXi7rdRsxb_wRtp1bdwb8r2rpmlUwEhNtg4xFn5XDWJxy_HbLFtkSob0YUQohaqlaO6QnZV2rz7lkz6ioWUGtu8kvX2uamRina49AxX69DweNQHgW6TQwS2fYTzpFnMhhrddzAKXGmBMF6znvaHXUk21g18KBFck9RrwzyRdGdYZTxgFGSbrql1Pv3wW6SK6zJa4giJPJ81djnLZ7A_ZJKjcm9PyKBw2gT4M8xVNW2FpBxzWmzmMX1oJOZE7k2q-0YsWcuGVuDUI4aVmYBXXsenZJ3Iz9QIrsBDVWChh05kQwUxeaiSFXQ84Kpo31LsSiBBOf5c1UIEWAtmyRNGWvLPcrLrzuFYDcLPhMcYNZECCkS4Wj2PQKHnAHLx2VkL3qsUOs-1L2oQs6HTDSg1FHMS1zeG_YVXBt8mS-gODplBswB7zIVLTr8fYs3B-2S5NUrSRgGrIN9J1GzkvYrJeA9qpwpjOcQecIktjJJohaPaS7WTXM9vzUsFjmE5bMZ2PqtKfMZ5L4JdB1MoKb6YwdMhW7CzzodUu80L7v5V4L01cwB26wJHateJyxZi2WOCfbaNGF0v0ZO59tEK0EpdBsouBkHQgQdHcdIbnqm_o4O4xtNsepp7bW5siibLsvzDDuwBxRo3d30ID6q_5ZPf2q2BuBowC6eS8Bfk_pbKYshHw8Da0BAWHw6S54LyQdXNcLr9ej_D57Zf-ArwxQg5-WLC33JfMOX4_zeVat4x_KJWxl74aZs4Wds1diTCP_xFV1p61U0ulUJQSNB0BlZs-8PBxp3a9nrmh1ZBQLSeLuvUHXF6qiCpIJiRMpfbGVFjaws4vSH5EEgfm2mVqBWLMv_6784OJ9A9KDdxC_Pm2KqRcSk8ylcyiPxoBB0Ijw6yoFPTUaI6O204p5slCD25VUUm5bsCF55m7EtpAo45VGgCBiFEI8RHFmtvrKKGiXgeEKuehFv0lV8xsKfe-GxT7hkY9Ir6kcNosdRhzp0pooElm9o0EynN9OXYd9TOSzGBQLyfGVzkrgkpseRuxe_EO6gw4jjjHuGJPeerj491BVeSwSyLF1GBDOsUHw2lmx_xsSTMGp5GIvEUrt-L5Q3tQy5uNrnA5HpFenReIzrhnxEm0Owy72_iZYSCB4BwOzl6bxX0PAMU29YdGxuAUiwq1JcCLW8QLBjTYW9-vG9QVUitZzIN0QsPy851KLPh1D3PeT1CaSXECsXVTbWONxhb0w-hEpffn4gx0pF8IIg31AKAvDf5ZgeAnFIhyAyj7mv3T0ecieZ-Ob3Brp_uvMM84ZH64MJSjUAYkVF6uyKFOpSR3oJ4zhislr3o_Qi0dhRr9P3Dwq9SYzpiBtCnjQ3pG5JY444KZaGqkSc35-E&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=10855745751645034000&adk=943508955&idt=89&cac=0&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 135806
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTA2NDg0ODQxMTY1MQogIHNlcnZlcl9pcDogMTQ2NTMxMTg1CiAgcHJvY2Vzc19pZDogMjAxNDI3NjcxMQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 0090 0
498 B 91ms
47ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTA2NDg0ODQxMTY1MQogIHNlcnZlcl9pcDogMTQ2NTMxMTg1CiAgcHJvY2Vzc19pZDogMjAxNDI3NjcxMQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiA5MzU0OTI0ODU4NTQ5MzQ5Mjk1CmRlYnVnX2tleTogNjQ5MDc4MDM3NTEzNTA1MTI5NQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTEtMjciCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjI1OTc0MQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjEyMzIwCiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xad964c27750e5af00000000000000000","13":"0x5b4f4b2e9b54cbca0000000000000000","14":"0x5bb5f990ba5c9ac80000000000000000","15":"0xe8b96ea205ea09900000000000000000"},"debug_key":"6490780375135051295","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"9354924858549349295"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame 0090 12 KB
4 KB 44ms
8ms Script
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1701064847761333&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1LDAjzBkZfW7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0MU-lM10t4m1xlK7VZBS18QGnruppF7r_nYuPmgUvInyXnj2Py5TF2BMvzAkJsCNDYuchV8cMlmHmd8wpeNhA6mKvT2n9nA7APTq-X2pp8rTPsMAOrU3lsg8S9C1Qw-Q8Dv-JEA3Lij6mDOdRNHNIgyCK4GWYvdudeVI4y0vHy4BIrft0yeBzQ7Qz5uUVoC8iv1TE_MqV-Or8M6NOgTc-it1id8V0yQv0h5bwe4sO3K8XDXa_DmJaaAjTomFRy7lIXQa1vXIUs2T6dFzTTuF-PL3seiR-cNySjEA0BHZLIi7btjrK2sK4eCRdmjLfJYR5bXhx3h7QmU2RT8V63go4N5qWRtunvwFCtnUkJqxZz1gzp864aUNCmPzwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIgov1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_3_6s4h2vDJLwTJ6ReFGSVbrW8MrQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BqhbjuSIU49eYlurqmIHrQz5a2jH2hnHOuzU1mpt7hz2q4wskcnwXsviePanswRSd0xR4Q3Ynz8IPZrq4igJkuAxevdBUNLVMBndHLSv8pxu7Idq5TFJk6BAO_DbbZ9cz76mdTPaF-Gyh8SEjGQ613dAUdRu_YcY8aMo61z3_mol5-OnU%26cry%3D1%26dbm_d%3DAKAmf-AXIJYwUvvt8ixpj9evsYDD4eFSMpwIydxY8INUxBsrfL1LvrRMxTqnvCkqs24eGcszSlKFE0ULzK9gWfcNwMVKxsHkMpl8IBT_ZfjdlmNtryeIT8W428vK4u8fTnOoFYKSaRP9qqt8aPhgjO--0FZx_xnnKO0sSrLlwNbbhJKM3O9e5vMDZH50poWXfJIj-K9CONNQn3CHNKIM3RVYqKOHIjYgmg2rGl8WMENqXV7ocy8QEJbNNwvpZL1lgzm74uUZCPJgrBHMkMSl6X3vUpwQ6SoSuLsEBMOLpc6iBrTlB_p8dK4IyEKe4mJYWG2tOwIiynz-9On_A7Sd0YyliSfjeJUe0L3rej6xGZOL-PScwircxAgtyDCuDs_6QJNB1vs2GRV6Q4iWWVsXf2cf_rFMSmUQX_UsM519uBgNzoQwfg9r9nJcedau3hClwzOuciakNILS-jb4k53Y-KWnT84qrAkNp8EysCueABMMycw7zn1pIQ213z10luMEcdTIIRNGer30lSFA4Xol3cgvTtw7rT6AajU5cTR77PfYq_RlE4KxE4y51ABQd9JSSlPnwbZkLRxAFGpg--Y4LOQVtBCv0LkTwg%26adurl%3D
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 32164951eadceba7fdc3b32af926c9e4de31e228fbd394757cd36301d4f10ea4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4273
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3873 38 KB
13 KB 12ms
9ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 135757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 51CF 0
20 B 44ms
41ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1306494321026&version=m202311060101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 51CF 0
20 B 41ms
38ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1306494321026&version=m202311060101&ct=77&x=1&cor=11199176347821187000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 51CF 20 KB
13 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CKKKRCJEJGWC4Mv1twgWb8iPzQ9BgFLYIOlcHUNRjPNBaHaUwrZwJqZjBRK24ZFKcPiHtpdx7IooK62Yb5zUInj1wK9FTntmtYXJlCt_1yNM3OJ7CYw-xMEHAh2IUZzao7abYwsmJ8u6iW7F6WHW2QK6rcrx-cTfn6RXwvcysbyUH_5DE&cry=1&dbm_d=AKAmf-DDtWOcWJXQollDr-tsrIxZl5NAm0KdfLupYNZD_HBspAfCSuQ5FYcEA5bjQDKmsrc3E2Ots8vNwePUpCz6n99ZOIYdfE1_R0EzZmW_PbJdibiGGpVf4bXl3-Cf9njnIWM_E_RhHbUTIU81hJw_XKCo4lDP8NuWYHiA9ApQWZrILOAXF2I4YwvQ0myQ48M9YlEh4XkOhFMeXqWMacSRfuZurgA4jwmlx1-LXB9QoKWaISeQDynzL8oK551ijtRls9iLhk3jJlnv47IP8JTjadtuyXG82xl4gJ16CW4uOIU78KEmesynSoD7BfU7IlGvr2wxhsg8RzIUQ0x9N800eDPE-FgI4ixlOWqqoxb9xnoVhZn2cfB8e3k5yLpQ4bwsHEIsOKMg7jubXBsmqhCYgWcba2XIK_evLsaJI6IFbkBLtyF6ANIe5dxIEWwBwb-f0-PCgIYjZWoQn-F5TXq1nJhXzTc_3wTBBTVzDgO320vqpEOdqbrWltAHN81pApvrkO4eGvF2baeIb8e9pKEdOVJ6g2vKxgOO0d2SLOo6r7bBPmaHlROEWq7HA27Sa9nobYedgAqAOBZszpsGChf2WyXkWh6n2Hu6onMA92bdNvh94Q1fDtCLWr76vcX2sMEnKO06axddoGl5f-CflUp3R84GgA2e3XyeUQYsUtX7tE8CzWArtOhp5DDz-ZJ16BPA1CNlOkCuRMM6ca4WEh2mF8lePd8jmla1aII4Ian5eXt6Toys0qES0E9dZ1MHIKTRXzsM7Hf5D2m21OuH2FvlFvhUgq_drz1NNCrtJY6Vlz7ptsH4qdVhhcYMJPTJOsMRWKNCVlW8yQuhlB_1vjzNR4wUlSEgFy6inoZv8xHUs9nPckSNBnPv3_fy7c6HbPw0-_cfxjQVTtrgqekwflzFddpOZwZOaHSUiJk16wkLvF3h_ZgSi04Qkp3CPsgm64kiVoauAn5m0rhGc1djMyjncxsKAxHhAuoCEMvcTIi9IvkzpVa75kMW0QYpUa_M_gLrQO7rjt05WKJzf5ZDRXvEWH-anov9YMOhY2KM1_4A5YgTmI5CzxPQemEY7ScmtFEAz6YN6LidwK-WtlU7DJB1oQN-uyG2Kih6l7-E5tRf8_oOyRh_TlyFqtvHpHOqqvHYdrWR2GORfqn9FCuWQsnl7NAFKmkgHsdprtJIAffQKwFPp409w4Y3d35VZTX4P0jVMqzWMKEror-_Zk6R9SmAT1t9Gk2Oenf6xeJyuHy6omiWlJhbjNlRzKfZVD_AiXBZVxi19MsmjHxHXmXql33W2u4UcjvbsoKhFbGCzR2PwuFou_n5Hg6uLl231hRBwCMisQyUaU1luOUfVPgkHBFAkn-eSMroOYdREl3sg7vtjTU7rCp_1GKvxaxNBfUjeDTxZt_zuEdwQAiMLl88X5ZNnMUNUvBErXfJw5sG7iK-mDhFi8WvD9iAOMpOF57y7qcTrhV3H8JCFcwR_dPyN9UK3YizLQfXzrbJSMN6Ds-8MVCVX-lkTYC8PHxUQiAK_-a-FYt05U3wSrfuPGz0J-ZUYAqZG-MdfLibJdUgvBMn0z4gvU7tqJgL1aBloM4-EDpTUWf4HlzWGPz_tydrULZiTvYKKaBN9CdSHhYY6pirs9vGcKtRiGACRD5l1naq4YizrhOAmMz01Lfeuyk3ruYKkzDSl1bryg1MUAyfOtcAf4q6eNENcd7CNyVKi1c4RaTV-4P6LEol6M5bS7zMurWNEN85D8sxnRCANRHIDOSBhMhkZ2smM2_cA8HIB2RyI7S8SPDxXmU2D9Ou1mNEu-Ww8XDfcveEkLwS8tKpxO_y1Up3T6pVpiukNGrbOJM5FE7hXruHRTMrlumZKNYL9HN3nU0N4BA8K247mgCqCVrEJa5MPqWCkorDbwsVR05Gn2SQd1Sm4RuWTYF5nAZuTmYdLJWJQFd0JgTeveli4YptJsKaMbKHnMcW-HrUsWDbCXUbG1SZ4h7PgRJ0S6u9yK-q63YRz3whpsphzvBJ17vMEAJK4A0HI_68CKDS_Rjte5uyvmIBXMA-W1lzNMJh1eerOdLOYWVvjdIb5C8hHfWT_ypwyV7jwRzlD3YhTcsXj5zJ8gqt9PukAdEYt8kZ-Ko6cjtwWxbuaYqqt4uDZztP8O1rV66b1XDY6GQFAfKikcHqupAENgvePuA-SfEgqV24G-XcLc_OTWLV0448cXHxIEj5Zi9h5OaTZkP2Gq8yA27schyxellQ2XgN7EfslFew9MQtQXnWK9n7y1it-zKHPLPPsKk6jl1L035WwTMA1AMgW9UEv0szfphwON99caDE7XgRUgKadhhgHnPWcbtse-_XCIkj64ehPrU19TQQYhQx2LWTbr2pQyHEcPQvDXG3cKshVg8SYf_awS1z2ufCalHGAj4mAaL2llHC25hmHPZhAo6vcZzmA5laUjQzL-7DBPV3OaquxOkiK1QGuvHPtmmVuyn1XcdmUFzA9VZ76wwEBor1b9YJATVXNjT-mzAGwU4gJKKylZUfLktiqi7z4zS0U_7n5QLCeCKiDlFfXAxqDv6DmueyF_Hb5ujBBKoGQrIbRJ5QQRRpkuN2IwiGvHAZjJ86PEKFRy0SM6qbTy_SUrgrRXYxmrsdF-OxYAIKxtyRcrJsHfRPWkbhJ-pajhbbrHHBhLyBPRHj3-wkmtVR-zv6isgPcwIKIfG1hHH9a_P1QW-gPsDlv25NyTr1tPddChQRazOdchcfsF0LOJTx-3vK0Y_wx3p6Y8EfuSFcDoJYQVDkLJoekBM0UAJz_YVMZZx-C98aBnE6woNGBVwAH5hDMpAs_02saWYjAr6rtA6zD56BHdz4zJhpC0O9xPUbX9m0IRUU971YSUZ2CMSzFbObMmtNqLRXDhW6Dojjuq6yQdnpZ8GPlQlbpUzfVG2o13OcPrLeVFD6JJyBZgTBpts0jHqFu21atu_xhqELkma-LPJs6OdwgEdktcXIQhq-qqULMFRYrSbwORMM9sTbiNhpLcSkE6UUsqLjc5vorGauwl0ns2E99g1t1YLfk0SJ0WeWWH64LsLamcej4tB1sjUOwLaVjDmXMWjixMDW8jzGlHmbFPiClFD5yu26-V223oaiNz8y8IJTJRn_ArFIy_nxKigNvUl_vKbBpbLDcWhwfDMkHT4rr36EAj0MNfYcykfyISXcQbSJi7-uQ4qg2iUJAwy-9WREk56KZAvXVebujNrICPoecVvgK5U9e6oE3dwbN08KO2znBinlOG6QSjkXbISng55h4zX9uklnhGc3a-cFl-dpQUroQ1hAoJvFEkrqmsWHmvMM4UYHiH7nF0wvbdx2fGmj7KuLe2bhIJ5Lh377Owgf980_AfVISZpwqPsH5JiphSadGypqP-6PzXUzaUiY-kmhS_52tzfbObcHRI5LbrXfU9iOKUULmQqATba6UKafly-eTlMXmaK-H_G1QLijlpQtY4Z6DvRktD3ENV0RprYwcseJhP6eVAStHZqrNz857Lo0TWN7khyrzpj5u22WJCGJh4cW5gT3mPZvRRMZB718RcNZJg5N8DROTqqPRZnLpXRrAivslfep3j_CZ621LVemm35yzIqZo0UGtxV6Jxvyg7CaXfAlbdgZqn9-9vfH7h_cgX4YlcnPwJ7IZIxcVyqxZibG2poMQCbE3DUWx59dw9Ff4JAd--gal_7baO3qhxm5px2x7hiYfg7BnAeFdf9PWtUcWrJ5-brgHFaSsD8qmQF3TG7hOPKcTwAk7hwE1z7MDbxmLlvTOE51NXUp_LqBk2SWxJ22bsIPiDica39_R1wgfkvWJPryk0KJQYge0oJcChbsDsf-8x6jnEWk7B5k2Y7T57eBd8em9iLMwPFPefwDOVtCFWFn63wEu6lLHzz9A21xyrTpaFey72CH9OugnXA8wKJGoIhTy7ZSyKiAKYIOGSOnelPIWp8b4YbWLKh-ohNQ6SCdOmqY88bHBOJITpDxtg2i_HjGGNnW5N6oYX2kLzubNOEOJtFwnSGpqg-lp1WrSCjKzkmsyHJ-pn7Kk0JmeuMk3ZQEgaaZ1w&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&dc_eid=31079496&dv3_ver=m202311060101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=11199176347821187000&adk=4188270525&idt=170&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ffa020bb3c8fbd87a97b248bf1d7525940a4cf26e4dd3f80ad50428197bd451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13780
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D9F3 41 KB
14 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DAVeU8tgi8u2WS353ES80nkxBuZUav4VMA_WYEBXxKn9TRczc4n1-jj83cehV8rF5jUMDDp8F8Yq_xBuYK9Pw-YWe2t7-CdRGdJhOwiBGZFCLTeNL_U-Ox5QJRm9hMpy5vsEwqjASqx8LP75bnCV2sOe69sOudjIfKlIbBwCKTy0Hq--E&cry=1&dbm_d=AKAmf-BOfT0ArtR10L1uWEip8ufJM6MsfHcsDNb88N0_y92hU3Tf-LRJK-TJLEDW2esABaNCqDyTqucTiNIZbbEHXSy_nGNx_UV919JloVslWlB0_nQZwnve1lSfe2BEKNdzpk8KPnBUL8UTeFjub5FCigB-A-XTamk4m2iRcxXTylpmKJ23M4ZgB0au777okf01IopB5FKqQdF2LPFR712dcvDFLLZDcD-UA-QShQoYQu10WxVcAm5kaXc9AVhy3VkKP6x32xNckZ8iBEnVlepZ6zjx-LLqzCk4w5pAg5edgftlpcyGuBcqMGlkJ_PtWtMjVDPu5AIklLu9k0sPPkfUDybI-zfIKIxQT6SDKAnu2cp2khw6xW3SVqo-P_IGMMhU8m-meF_r3xQfk2QcfY23aVzAlpCnJAH4u-RgJAQTV7RdPw8yhL4NGdXXZ9_RoshGqHigyvCsasDIcqR9_ZUEmXvKmJlRcBU240a0wBSSAIchArNPFGMhckE24J80b_IHKLf4Z4WSGh88E9YlqIhsEyouXRlBzoHoL638PY4qoPeKRfqltI_zmhnjLjWvujy3eAa1nQpbGaEFLR28PwTuD8wSuJu-CKc5oiMASw_TlBLWagIun3fQxxjgKhAhaVStVnhFpWmKKCAPZveC_wcJjAyGPdcLqCIh5Ik-mh3fuds7GffgngbEv5aWKvqBhJLClm6cYsAjt16PCzSM_Kpx706HRjjx02jFe7wwREEwlNL7ZP7b-V9-QWbRxTdJa7X3v_IoLjp57UwsLd3ciax29vDv1xPxgnMQ4rmuswXO-81-oE0lb-UVlPZptAT5m62vvfvew9ZsIWJGoGUDaTGdT9RJLmAG-T9qguYHM9u4VdVmQ4MKy1IaDb4VqH9nXBnPhYvn7TIz9vlKCPDFQrbQw1tveS5sn8I_6zvDwQ2b6CssN4My5fBOX2W8I7G2qHuKB8l1ocZTPlf8mtxB1sR7hky-9itzrW6b3ImYXA9P9UgTBXKpd_HnqSjhbTPeWGZeI3gAkRAmrDzTiAL_L64aTAn2lVmLjDtfPq3Zb7jQ10HxiRcGd0bdaqZkGsUdbKcRjZuIkM0QrYkN7NomAx0lrZ_XxjIabgmPMf2GexKzZCgf7nRtfi9yhjiyAF5DyCTuz8y9ycqaQtUHf1lSZGKUQ5Aq614sqVmA2ZUvsTLzD-EaKg1EFd0Eoas5sxlwe8DTvsCBO6E2DNw_ZgaCcRdcqI_DWRiukP-v8Ego3P9rblHgYTZ9hPiAU0Og3w15QrcMj4gz13L_B--DZitdyZDyJLPN1OQDGs5DeLUR-WabNAAkKvVJJ2Ycyl5xOfh5mh88R69kF5xK7Kqsc3cFiuv9KZ79RUXMNQClBJIfz3wjLqlRNiqvsrnLqlI9Ctdfb0WMn02edfdJnt4V2EjtAH97BQSoMQFiOSji42uZzHPS2jZSVmlgnMsaWeMpCc0uNEw3n9RKNSVfK6pUPU54lfrWa74RQlmEwxwAb0FPC0cJ-lTiZ2eZNskGQzR69KrOHKtqI-KsCSbYDYLF8vq-GXNlYnWxHmc5_7TNndOLKRpK7pzTf9V0frGCapZCL-7p8AtICiEmdEtNI7_NyrQ-DrSR-ceIb1ZHN88H3xQAjA7B0gmryJ6wxhMrjIws2AYGOQvCprKAPCq5kMoa_FiDtNBUz24lwFsYCHoTnYVGBcE6FBw79h-WrsblD43RK4Bz4EFEDkKV0hQq2v8aC-cH1Xl0N9a_jkJWrMh4AarZIKO3ZpwrW4jbDMFK9qPYq10X-bBx_1YZaUO07Tg2uX1Ky5Cefru_J0DtsLmgAkAYxPSi4P5j1nCzygzfKlsb3M63_UyFNHjGMh9kd8Ec9l7t_BW_TBklnIwRh1nwI3ctGZC0UQSo7bSjTs9GRq-O2-feMbV77YfLT8SrZXSpXoQhIJSif6lhocrnTEO_g-U1OUtBaWVgn5lgqmOAZDEiyzghMe38KOuUv0pJtyb4Kp9pJ-KzmhSlBGFAAXj9Pen7MRNS0FgQDzjGllvYclyvlgsG7Y77ljn2WCw0xDhkNGiinTPW2JYrakn73RaeFPSKDYTKx6dlfIgBRpmdem_Ro6nyK2gCoqTTk_mjFO1U0_oriLUXU3NQdW4iExh1a-RD2nA0vAHrExfzxWVw_e4X7FDpBwe6AtXQrtryD_W6mK6v3yeed1F0yfQz3NyYLlSbCJAJqfXcvKgWaG8GfGLt1uZyz2NBXrFExQgEpd4DnumKgYqqdQyBXKtc8bA2szIeHZm-Oeoz5z7bP73ZEDFyhf6B4cixt91S9Hj2Xh8eUU_nh2o8I0QksoaNgiypfxOooL7peyF8rrKdX-YMHwgXwLEd3I-mW1iGJZD_Lxs6vX9uXhEu6giND3csAno4_QtKZqitKGpBEbGW3can-pm43_r-OOjQu6QT65BAc381jh0QUKPSOYl1TGczlRvGUcZmDmPWS3nPPN1P1bmd9tkEVJQ0NHv4Pls8QJ9Ry_lIUbsKBY7DG3AtchQUFccXNVjDKB-IhCWK0rJgGfrBO3s8H90AbKMlk1hLT-WTz3Sy2z16NJqv77msXfPOSWx9lHFzh-w1dssVP0YwC8E0qn-uUOvkN5PBT-jNVA8ZsO0f70dEiMrl3uiMOgzw4M9ufxavZoWgLUilmGQraxVGfWpiv65QNc2BGc7eqRvM7OtkNB39wI9CPL_eOAAE9qJuyibFGizBjBqSvsN35Il25SHfIuHoDkcmy3ZdovpFhBfVP19q17VpUNmsxswi5pvHqMWjmJ_OGG8q5R0tyWEr5_PoD_QeNMfqwCq0QKCj8dZPG5OmtLKp8eAwV6x7VfKKLSsop5QzgXJL_hybes5B7yAaBWIasG98oMIfvjp9fspqPlkzgGJgmPKiuPOzwKISu6RAZT6l223KVDq1lXcCtcdNqcucnyTwdviuVl6SsupfNZUPlmpY6LqwgGy5_5cckEef04R5UUWKh6ALpQb7Iz21gruzeBEIpQKgrPRFyRnovVo9uhek5UJKXJGYFgUR9TIofzyTvnf5GBL55OhJG99BokJlz9itbcK8RAqb4Jjcf_pcXnhlGgvG1q9UNG9FWfm_AAsEPMIWtM7WObqPUS0zKghkhuTyRZigmT-yWE-dH5mOwL9i3FkKkCi52Bi-vqbxuxpFSugu-XM4Bz_H_aCoWH4LrmRd1rVo2r57zkm17mMTiysjcAw5YnRhsunJcgzzvYxHUhrSnuxan51BUFhQiou_VJoT_W6htW7XmeJGm6lyn-fsMQSDo7q35Zl7BJ6XlQp0Vxu5EMJuaD3hoLVn6BdEoTEIayIT-mU93myiMfi98edXBxuiyO2pbuMkq24X5yOOzlbueWLC5nSSLCZseeb2iNrcPl63fUIUtl8QrSUwq1N1HOM3dyTecuFrWhNsOMD21rrtolYHHjQLQeyRyL6QmblQ2KalWjIBhrAAU44CedqdUyVkDp6uKDqeZCdlHS2OVEVxZCvOKqf7AmE5NlvV3Sk_0CGTdWeuXaU1-JeW-SkOKJbhdyondDpu0nWjp-vc1vsxYg6wJZf5AREhG0YCyoB79ntzTA6rqKr6IC5FMKyD2_4r0aNHwdidjB_GBa5Jjz48TKEugViMjIrgy_tSc7G-0pm5WfCH8-Kbbz9DXcIQdNNu2HGLOp9gXDrMToV3HIuBAoRm9lbK0SnEG_tHXh46DCzVznBaKrB_bBXnmjMGrVYtjuJF2mAmZZb2siRP-_pcBT1Ug0NwfUOQpyG4WmAIzjkt2b7d3qPd9Tr2an_JZz8SOebXFFmtFw9dNTR1YUr9RC3IjMdxpj-Lq9xMFRHAa1w-ivB49G7wdxEoXbf3XGMC6-vTe7qdiEMKZn1EQjH3NbozNujOVEbISXpe6VdSaJAaVyaZf8rs17zatcyknF7vp7gUV8jmc4rK0IqRZEqY7WHvhVKN5BVq2HtnzHHrHRFOTGEhJYXSHHcmENC2SbHVLlwHq-7CiFbj5QNWrFyia9b9IC_PaWLehdZhzKi8ne7V48oUi1feF89Mevi0Z1461QzEBUbzRQ70wtT-C-K8SvpqHP8&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=13111126243688905000&adk=3690638929&idt=132&cac=0&dtd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 135806
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTA2NDg0ODQ0MTc0MgogIHNlcnZlcl9pcDogMTM0MDYxNjc4CiAgcHJvY2Vzc19pZDogNDA3NzA1ODQ5NQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame D9F3 0
858 B 45ms
44ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTA2NDg0ODQ0MTc0MgogIHNlcnZlcl9pcDogMTM0MDYxNjc4CiAgcHJvY2Vzc19pZDogNDA3NzA1ODQ5NQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAzODMxNzU0MzA5OTEyOTEwMjIxCmRlYnVnX2tleTogMTQzNDkyMzc3NjQwNTcyODYzOTgKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTI3IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIyNTk3NDEKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIxMjMyMAogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xad964c27750e5af00000000000000000","13":"0x5b4f4b2e9b54cbca0000000000000000","14":"0x5bb5f990ba5c9ac80000000000000000","15":"0xe8b96ea205ea09900000000000000000"},"debug_key":"14349237764057286398","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"3831754309912910221"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 3873 39 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71040
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Nov 2024 10:16:48 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame D9F3 12 KB
4 KB 23ms
8ms Script
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1701064847761334&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoktJjzBkZfa7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0Cj_4MfMx5hc1jcRRv7J1CImTokLVlsA2HXYHRDNdv8kp3uRUCW49nIG1hfjFbFblgMNJcbsEg5tXGoOxTapq2IAyJC8Bt3haNLT9YtHXHRvyYbxngnypTT7E7p1sr1GHwpv5_XNAWga7O2olgE4_jqZdhWDhuWW6qFTiK2cFnuJXtnlVTCPBhP1kO77Nv7XXrXzfqe581x6obVa_AHMkA8nqX3X0ap2emUaJlY43ZNMX67NgUCXEMhkFiCfr25yCI5BC6gYrziH1sa72EXWsK3AW54_Rad4g1r2ytRjTtM1WGbblzeHVSEABeXC1DTDZCPD1W1VAj-JsCU8ooGdAlGcPwm81r7agsKun94vh_QTTNzt80D9aHWVwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIg4v1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_0hDwJNY33lqT9ob2Nc13CMBgKtpg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DNKfAv-jd615doY0watjNXP3SID06eE_azra4kZ45JtJsBn_5tMVg3Fi71svarXgMo2nFNBX8MIipevXinU_CCY9wLtkCQ7X-QagH-y04bxw9EOKqBXjsPnmv7tej1N4X44dmVuftsVigZxXhsDJzxBj7vL7QHY1__2scoPQKafaokMFs%26cry%3D1%26dbm_d%3DAKAmf-CY0aE1bFYPwD0tXJxXpaaDgfuXcHWLCR531vIFkxli1aQuLyOndETBtY367bHEpzmiWzWPwhNfSL3TAcWidMZ3VQSHwpYe9CGWyWY2yY2k97tPtBqbV10NotblxFJag6vwsmZJ_YGMGN6fKBq91STpSCfZUurUMj8qw3GQfcfEckD_2VLQmlLqVwCz-D1cXa-79NXO-B82PTeR4nIXmsK16EksjqsePS5kf-wQHTGfg2pwZU8JyDSnNuB70cOMdl8Uo6ppB-SKK2ROSDNLqrC6p4hTGS97J71dcEK4kuvAMIRQdhpgpd2Bqt81cBnc_DhYXFuR9ui_ck0z8yrO6E4QsdG4dNPOstWieVn06wtpNsIOH33gOMywoI7p6PJ4ewmhJo8kLEVB2nhbGEdAhrA5AGjmxhDaA1TK-JGG-jdQNYcmdgm2244_poOP7mAnsb1jrrzPtWQMseTpsHSFxQn0gBuf58YbLf3apM894M9O0ogZ4NpcHg5u8nbP-7PKjmEK9n6b17qYAgQIQoqIl99mOXHI08bgbWe01ctVOPrFjiMchGyWexIu2kQ3VFEF4BwwA7EKd4OgiJFnyfvL6elN5jtS2w%26adurl%3D
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: e955baac58ed78fa39d56452856e0dbe18d9bff47a6f459b7445bf4fda993a92

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4271
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

request.php Show response
hal90006.redintelligence.net/ Frame 0090
Redirect Chain

https://hal90006.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8690c50e58&subid=&uid=97371124d3684856&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90006.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8690c50e58&subid=&uid=97371124d3684856&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

86ms
71ms

Script
application/x-javascript

138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8690c50e58&subid=&uid=97371124d3684856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1LDAjzBkZfW7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0MU-lM10t4m1xlK7VZBS18QGnruppF7r_nYuPmgUvInyXnj2Py5TF2BMvzAkJsCNDYuchV8cMlmHmd8wpeNhA6mKvT2n9nA7APTq-X2pp8rTPsMAOrU3lsg8S9C1Qw-Q8Dv-JEA3Lij6mDOdRNHNIgyCK4GWYvdudeVI4y0vHy4BIrft0yeBzQ7Qz5uUVoC8iv1TE_MqV-Or8M6NOgTc-it1id8V0yQv0h5bwe4sO3K8XDXa_DmJaaAjTomFRy7lIXQa1vXIUs2T6dFzTTuF-PL3seiR-cNySjEA0BHZLIi7btjrK2sK4eCRdmjLfJYR5bXhx3h7QmU2RT8V63go4N5qWRtunvwFCtnUkJqxZz1gzp864aUNCmPzwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIgov1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_3_6s4h2vDJLwTJ6ReFGSVbrW8MrQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BqhbjuSIU49eYlurqmIHrQz5a2jH2hnHOuzU1mpt7hz2q4wskcnwXsviePanswRSd0xR4Q3Ynz8IPZrq4igJkuAxevdBUNLVMBndHLSv8pxu7Idq5TFJk6BAO_DbbZ9cz76mdTPaF-Gyh8SEjGQ613dAUdRu_YcY8aMo61z3_mol5-OnU%26cry%3D1%26dbm_d%3DAKAmf-AXIJYwUvvt8ixpj9evsYDD4eFSMpwIydxY8INUxBsrfL1LvrRMxTqnvCkqs24eGcszSlKFE0ULzK9gWfcNwMVKxsHkMpl8IBT_ZfjdlmNtryeIT8W428vK4u8fTnOoFYKSaRP9qqt8aPhgjO--0FZx_xnnKO0sSrLlwNbbhJKM3O9e5vMDZH50poWXfJIj-K9CONNQn3CHNKIM3RVYqKOHIjYgmg2rGl8WMENqXV7ocy8QEJbNNwvpZL1lgzm74uUZCPJgrBHMkMSl6X3vUpwQ6SoSuLsEBMOLpc6iBrTlB_p8dK4IyEKe4mJYWG2tOwIiynz-9On_A7Sd0YyliSfjeJUe0L3rej6xGZOL-PScwircxAgtyDCuDs_6QJNB1vs2GRV6Q4iWWVsXf2cf_rFMSmUQX_UsM519uBgNzoQwfg9r9nJcedau3hClwzOuciakNILS-jb4k53Y-KWnT84qrAkNp8EysCueABMMycw7zn1pIQ213z10luMEcdTIIRNGer30lSFA4Xol3cgvTtw7rT6AajU5cTR77PfYq_RlE4KxE4y51ABQd9JSSlPnwbZkLRxAFGpg--Y4LOQVtBCv0LkTwg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6228476358046&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 7416da0dd1017045341aa0bc679936b8f57f1af7729084efc93e5286b8ced6f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 78339700016663304444994012521006
Connection: close
Content-Length: 1327
Expires: Mon, 27 Nov 2023 06:00:48 +0100

Redirect headers

Pragma: no-cache
Date: Mon, 27 Nov 2023 06:00:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8690c50e58&subid=&uid=97371124d3684856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1LDAjzBkZfW7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0MU-lM10t4m1xlK7VZBS18QGnruppF7r_nYuPmgUvInyXnj2Py5TF2BMvzAkJsCNDYuchV8cMlmHmd8wpeNhA6mKvT2n9nA7APTq-X2pp8rTPsMAOrU3lsg8S9C1Qw-Q8Dv-JEA3Lij6mDOdRNHNIgyCK4GWYvdudeVI4y0vHy4BIrft0yeBzQ7Qz5uUVoC8iv1TE_MqV-Or8M6NOgTc-it1id8V0yQv0h5bwe4sO3K8XDXa_DmJaaAjTomFRy7lIXQa1vXIUs2T6dFzTTuF-PL3seiR-cNySjEA0BHZLIi7btjrK2sK4eCRdmjLfJYR5bXhx3h7QmU2RT8V63go4N5qWRtunvwFCtnUkJqxZz1gzp864aUNCmPzwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIgov1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_3_6s4h2vDJLwTJ6ReFGSVbrW8MrQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BqhbjuSIU49eYlurqmIHrQz5a2jH2hnHOuzU1mpt7hz2q4wskcnwXsviePanswRSd0xR4Q3Ynz8IPZrq4igJkuAxevdBUNLVMBndHLSv8pxu7Idq5TFJk6BAO_DbbZ9cz76mdTPaF-Gyh8SEjGQ613dAUdRu_YcY8aMo61z3_mol5-OnU%26cry%3D1%26dbm_d%3DAKAmf-AXIJYwUvvt8ixpj9evsYDD4eFSMpwIydxY8INUxBsrfL1LvrRMxTqnvCkqs24eGcszSlKFE0ULzK9gWfcNwMVKxsHkMpl8IBT_ZfjdlmNtryeIT8W428vK4u8fTnOoFYKSaRP9qqt8aPhgjO--0FZx_xnnKO0sSrLlwNbbhJKM3O9e5vMDZH50poWXfJIj-K9CONNQn3CHNKIM3RVYqKOHIjYgmg2rGl8WMENqXV7ocy8QEJbNNwvpZL1lgzm74uUZCPJgrBHMkMSl6X3vUpwQ6SoSuLsEBMOLpc6iBrTlB_p8dK4IyEKe4mJYWG2tOwIiynz-9On_A7Sd0YyliSfjeJUe0L3rej6xGZOL-PScwircxAgtyDCuDs_6QJNB1vs2GRV6Q4iWWVsXf2cf_rFMSmUQX_UsM519uBgNzoQwfg9r9nJcedau3hClwzOuciakNILS-jb4k53Y-KWnT84qrAkNp8EysCueABMMycw7zn1pIQ213z10luMEcdTIIRNGer30lSFA4Xol3cgvTtw7rT6AajU5cTR77PfYq_RlE4KxE4y51ABQd9JSSlPnwbZkLRxAFGpg--Y4LOQVtBCv0LkTwg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6228476358046&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Mon, 27 Nov 2023 06:00:48 +0100

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame C8DC 38 KB
13 KB 11ms
7ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 135757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D472 41 KB
14 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C4vfQSLn2ffvukyXMMfHZTZJv8bq6o8e2x24eeNiwCkNLPluJErv1bKnph7Q8CZvrnBDAnfLiuiAlXl4v47ExeN4ltWInJMwgNsniEHgpTHBZajax-BsqVDplJFgahYXjVWmRdZtPcfiAIAX5_Ac-e-eeb44DlYVyKFXGrOHOTWR4vu08&cry=1&dbm_d=AKAmf-BrB_1DfCJ9W-kl-xJs0P2uvJta8Z9yXXJtaKql8SNMvfDxe5wCsYd9nxRExq3QupD1wvJzLf0T76_-F1-1AQRgT8vieMbI9J7q0E0veL4_28PUVLwMfVerPpAJxcIyZ_mlQCz_8OgJpKQOLkMhB9Q8R55y0rS5cKrmF_DXEs8DN-PMH459x6Yg_CqQpu84U0SCRWIPMJDSTJOm-4kOErVImi66POdEE1yOKjUEv1j2piSu98qUzOLItElRuyamfEFKLXT4figCt-YeTSZflSOEQO0XL9z87yG6XFVIZbbETSashShyh7HXJy0QUXrcUY8Gp6aeHLqsVokZimb3gcD0smu7InPDVYZxqITNPTCMkBqfiL-O5hz3OzyJyFf8K1NZ4pafjVLSt4WA1vMGU6fkeB_LeLTsXPsEdKqAyGM_LGOJeVEOHjb2i9Y-YUxjd6PPjZyGltt02NhfrPdfG1jl-CNoLQsZ4dK7Dg9ybZD4kmSr-XHEi_uCOMPhov49Fx1j32sf0kJP8bqatDi9rUherHZeZPQFvgvn1aVtXuCedDoh3Pdhdj5PIaVm072JVh4a9dgyVg6OqSBsz0s87Xh1PRo2XzuzXc0wC3DASOHDyVtuvVXQ9UQ6SlRqEp8sBQERq45MpRWhFViAj86L813I4j_ED7eq86AFS70rGioxdI5it3c0S4GvLcMQP24_H0pmWh_MfNCtq939FNvqW0izwRJP8qQaVXF5AkAOVroSsk9yK_IkP_42hvMYeOGspjqU4eJQGkR6hPwDQXllVnBHK9U9CRzHGyts99v7INIZvopTdt5P9fWGIlHhQ8vl3HHOPu7De4k_4mOTaY9zdoquimaOZQX1OsnnKJHmj0t2l31TeSM8cFMBmjK5_9NaN7O21_6l8wlX8DJAXWAkoI66LN6f18Tx4iRe5K98u4ASz8heiuA2wHJV0ZixWe3mfnRJfXq-I1t_C_HuNOZAjtstfC32VJ3oJ4rQqZ5uh6t08kbWoCjpaiAs50pgO-nMgOUYZQIL_UGFAFNacq4DJR_xtotgvUrWRENFojvqAjLX4w01W6qyn8Cl7Q70CUsz1AmQ1ACoToCKRScIoarJC4W0SWN_Cx_vHmlGPg1-CNsipN2Mi73zBFr8tv-8ommX-n7MxZIuJjILrzMdjWn_9P0kDzG9wpNqL88l4yXV0lHqELfgqbqNHArZpe1beBb_IhC_fmM7P0rbcFA1g31a8tbP3FXX8qh_qG_pjLnlhjMgkr-GI4HidlNqb1c0OQ5j34CVmMron-Z6qzofjBvB3fy7i9MU_g6aYH1SFy5ln1_ixWO5vadzs7KHaJLzgjdhZxjHzgWnWp93eRM7PfOQ5gJK1XquNhDaqeQv8p_KLl-9zh73JEBwJ0aNBHZFXWPwDSTTGvXfybbTKSnjElNKiEFu1rX_3-17L7wSwb8Nbpo0Rdjg6NzW7j9bbDgxclZafmVJza26xfPLT3fWaFFSUqYnBsvs4kHxnGnVpxI17ke8f8uGHC1L5escDlavFAAWKWwUC5TbsQl7Whun8nCxtdwoukBLAqu5n3v2i5Y384K2diWNa1-zKR_BZC1_7HY2pKoWUyYcoN6fvxO0oDr_-JPWENj8-k7JLT4ZhCGcCHULkxSIeY9L3ei6Gky8f8ORuiAB02P-aPfInE1OUdC4d5tw2FAW0F0TQoZbN67ggrm9mOX7JkdzLiuPqEufY4hGq7M5VuDWP50pKGA1fT2j1hJUAp1A9EoptdoXHBGdM7dNxMdv7s4FflloI4xveEoELJC3I9ASc7OnnFg9YRqZrplSxbCi9L1Zvb6rGXLnFG1U513qPkkWOrFaiwbzC4gYO7_5qvAy0KnNFjXlgI43BRtZeA3sGoEveZ93ghKL02uC-iqctCCL5j-h9_e-xgs_37cGtD0CVZwmj6JZE5vaxZtNNDMiwFS8QqpWal4PpR8lqFm7A3PPUP9oL5Z73nx-OdihYuXPlpAoapP-QtUECfSICqhMPor8KKItGDWZqQ57RARf2G6CHybq3-fiy0gy3AiLZiVRj9dECxgLpQCxKwjtCaHS8jqW6YsRDhmUUA9v6G_f4krtKCRstwc7QwIu7nARG9jcQw7OviBQkiibN43GXKi_TQZkDjzvo1uD9qyXVZF6O9N4sJBTcKhjuXhBqExzER2_I4PJlu55J1Ocvo9ii6hpKpoprxapTzv77p2630kOpJsq0cOEQlzJCNmWLGVCML12S1PAwkFr8Z_YXjxi8QBJmXIDtABrlyUbXoumYt8vjv7IJrQVIRDQj2r-0EoCqoQBx1NtrMHsHziT8FTMuThkPgwX4sXNL1vuseIRJBRvSqvuSj8V5ItBLZMFW7HXyt4AAR5NSISiOci20mNLzfIuqNJ-Ys0QT9cxCNt8BVnYKerFDpzaEemgRKipg4dlbgeES8bbYOtr4A8CKgDUnFYOAt2kpuNiZbfN5_ClZxV1rLxDyegOUOThMNl9YRuTjNKfB8kJx5wjFY2n6jZTGaNWkikRJViFZ31lM8SBdPWEGOmhwJQN9SuF7F1MGD2CYi2d7munIxA35-7tN7Y4_57FQSud4ePQ7zTCsADS0ikKGzdsifMfdbBfKn2-w26iTuZKMppSdpyim5qVkEUE3aHfUtHtcRSvo3q7F7kPcwZztANOp-WZYK4VXXQKpCi-7NEYXxwrJJ7pVvecrH1tLKtSdeavBckobuA_yVGxBMhdfzvpRbOWSWQSjzB2ttktR9tbyQy32mPFE9p8gjpSv39Qr4vMZi7ckCh5LdPLEYlTaozkiZoXWYPI3Tp9f2JkS0mqWyDi4C6PiQ3RIqE5NZ0u1oR-aV2QtIG_Fy0E3uV8Luiasu9KBYC0vlCItzrrDXLl516worXQ0XFpiXhbiRw1pptLMDeGx9C_yDYcwK_D0nFsK_ZyQwiO2qVsN5lppnIuE-S35ZGDyKRy2WrCd07X23AKz33ib48fGtSYr2F0yTD6HMc659HJJI1uLZC59IIzfd7lbicsJV_O1U8uuGaqCDUDSjQjXgaU01-z7_cA3N464rLMW17aHctPa56GVxTCxuUuQF7mhgUpfRbhpS35D6nFRXuP07uDG2fzr_S8XRkxn6jopExH82JGPBVH1j6XyLnrirJ_nIkuKjBlKqg6NMi0yx7Bp6otQPEhvAkqbW_VdPl5-AhgoAio26U_89Us3D9yRqf8CEIx6GXC8UdcDAMLCLd_suA-i0fD-CqZBgiI--gwPVwYGuRpU0oBrDEkuUPDn_a56X63A57t8dQZA0m84bCk58qUBS-obxMI8lHd9pCzQeCfPpfZVEwwAxHAkm7goqS0-5pwdAO_bsGYflUzFvvT3U8crig0DmUMgZjG95hH5ql4H8Hix3IXJZWApopzAk7wOzmaZ2gFzXc9608C01_SdC4kBX460rU0F-4eBENhPxt1GMtbH9eTVhRMr2YS6BGVhmjWhmoEJpwK4CRzgwyrGp5IwEr9Zpg5BWNnztX44hvRbtZ_31zD96mgPyLFVHbAR64o2Dcj9yxq1B3VsnMfjM4-GoDENjIjhECTTl1ZmZFo9_qrwvRZXm4AGsf604PVnNY2-u_pcnhPAi2i_70fbKhAx4AFyp7K6MtSYZke-rCNJ81HRLIepnMOZbTDy936WrAOwOPstLrWus9uNN4oUGF3I5qhzBPLdnl4DOO3qNXEpGmERDUiPpH-Jcq9vckyCBJzc1I8ULschVMl1fZJjHzB6aDponTEe6OTDcFMnMi5j_tasRimjO1Eb723Z1H2rBlvMB3Pspbgkd9tDftbER710TK_pobuHCrRACwjYMdMXcyW0hPdzaTrx2Lb-72VadENMx4lPRPtrqVvCbVPkckcr0TqqqPJ8tX_vfazU_APmcAITO5UjRFhIh3IlxrG4bmCXX7KsoM_ksPEf0n1sK4k-qaHhjqJZ5Cv_wsJR0chfs4wZiABT4XCYBsb3ZlJEeEgHIE5mV7YrGpTTBDrvUDiVEPMuKKzuTzVOaX9nB3Pljc1DiXGuoaeYC59kiPJevLqi2QTi4nTiw&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=18306730554864472000&adk=1033480531&idt=134&cac=0&dtd=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 135806
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTA2NDg0ODQ1MTg5MgogIHNlcnZlcl9pcDogMTM0MDYyMDQzCiAgcHJvY2Vzc19pZDogNjU0NTU4MzAyCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQz...
ad.doubleclick.net/ddm/activity/ Frame D472 0
497 B 46ms
45ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTA2NDg0ODQ1MTg5MgogIHNlcnZlcl9pcDogMTM0MDYyMDQzCiAgcHJvY2Vzc19pZDogNjU0NTU4MzAyCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQzCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0Igp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDY1ODkwNDk4MDY2ODI2OTU5NzcKZGVidWdfa2V5OiAxMzkyMTkwNzQ5NDI1MDY1NzI0CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyMy0xMS0yNyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExODY4OTQzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzMyMTc0ODQwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA4NzgyNDM2OTYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTY2NjAxNDIwNjMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA0MTYyMDg2MzgKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2FkLXNydi5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9rbGljay13ZWx0LmRlIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0Cg

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xad964c27750e5af00000000000000000","13":"0x5b4f4b2e9b54cbca0000000000000000","14":"0x5bb5f990ba5c9ac80000000000000000","15":"0x952b8285a5397e380000000000000000"},"debug_key":"1392190749425065724","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"6589049806682695977"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame D472 12 KB
4 KB 22ms
8ms Script
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1701064847761335&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCQ-XtjzBkZfe7LvvH7_UPkIWC2A2m5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0N8Rhx8LVBgT3Gg_AAgSjDE4EV9TixS-5vKRmnSHAulfRNflxjOO1RLl99pfza67zECQuoMB-YzKbc9Xrq94WYRHEZ44gZrFag2b-TLoBYe_W9IVN-uH6vz9L7bLCVJttKR9mswsCSNTfLu7pyfWwDbPHSQPs9az6j6t41AnjMZPPInAxloABvZbwSNpqw_N5hivx6sZwhcyL7tl0SbupTLHNs1NQz0fGfwWCWj1ExYylnt9VTfutWwexXxdPPgePHlOeR-I3fl7a23sRORsUpAjyp_fKGfLhmh13FyKiuLUYSAts3rRr4Jrgqxhes670bFWZLCzlyHccgHjgd3ROQgAK_dkBWEErwC735MFfwi-H5BScba57vHABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiEi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_2tbI4lgdp7YasAEVGaxUPbG-wByw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AJFsS2ayoozU2mSnIO9-KImvpsVo595CxkW8wMHqEc0wFzsNM-ZlHEqdoVvmXizOYgtl4jHHB9CfGyIAn-rgXkztfWy38dfZuGmu2y8l14WschxW1vEtnr71c_glxIAth0jJevZhEO4cYXcswRvVLGF8iL3qfxPLxVVwkscuiQZCCoaTY%26cry%3D1%26dbm_d%3DAKAmf-CYgChhLlYQJdmEPWLFo317otsz0IuP8X8YcRKYe7sPn7MHFQXkairwtw2rwdiPhEwNuUu39y0aiEspx6LGuCpgEvZh62CF3j-diQ_8QfChNnAIDs24VvnRe4qCBN5xrHssm_oiRtjPuuxSaLVtListSzUIU0y74_DPtd4yGv0iv-8_IggCl2nFmv-la0bs0kph0yEdX94RJ0OXkDrgpTYhXFpiBxTNXwXOQcHeEMyCTWiUn0UifSCjH-BUzIQIRkTAhH29ger-roRdX7bj8uLES-5i9Z1C-SF5CIK3UUrn0WlY1FxBs1dNWVzPnxJN0nbgStpBy-wj6nbh16LmaOu-LKqOtJWxGdHJ7daRCWiINogXnlhGgSF8jQd2F9M3Rl5JGBkoHcW61zLYFLWQIVxq8phLTxxBUgDeJxOirhYfPyw7uHCkqLJ2kSsBacRzSntnEbEnYHktovC9-bpMaKM4WM6p2DtiGMIgbTpu2Wo4BE8bE4UFYabAB7dIzStDb0tLvT6vUNxOLaY13019eMUWYJIETYUD7CisZBBO1iDvHHa4TVmfSX8YhldgOwjW2opR0RyvSZZDH_dIYePdwilYpj4dvg%26adurl%3D
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 2565570031ded8656bd8586337efb9c44841aa361d5ec869f245bc45ce30e3c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4273
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

request.php Show response
hal900015.redintelligence.net/ Frame D9F3
Redirect Chain

https://hal900015.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c0e6865111&subid=&uid=022afca568fd034e&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900015.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c0e6865111&subid=&uid=022afca568fd034e&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

87ms
75ms

Script
application/x-javascript

138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c0e6865111&subid=&uid=022afca568fd034e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoktJjzBkZfa7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0Cj_4MfMx5hc1jcRRv7J1CImTokLVlsA2HXYHRDNdv8kp3uRUCW49nIG1hfjFbFblgMNJcbsEg5tXGoOxTapq2IAyJC8Bt3haNLT9YtHXHRvyYbxngnypTT7E7p1sr1GHwpv5_XNAWga7O2olgE4_jqZdhWDhuWW6qFTiK2cFnuJXtnlVTCPBhP1kO77Nv7XXrXzfqe581x6obVa_AHMkA8nqX3X0ap2emUaJlY43ZNMX67NgUCXEMhkFiCfr25yCI5BC6gYrziH1sa72EXWsK3AW54_Rad4g1r2ytRjTtM1WGbblzeHVSEABeXC1DTDZCPD1W1VAj-JsCU8ooGdAlGcPwm81r7agsKun94vh_QTTNzt80D9aHWVwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIg4v1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_0hDwJNY33lqT9ob2Nc13CMBgKtpg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DNKfAv-jd615doY0watjNXP3SID06eE_azra4kZ45JtJsBn_5tMVg3Fi71svarXgMo2nFNBX8MIipevXinU_CCY9wLtkCQ7X-QagH-y04bxw9EOKqBXjsPnmv7tej1N4X44dmVuftsVigZxXhsDJzxBj7vL7QHY1__2scoPQKafaokMFs%26cry%3D1%26dbm_d%3DAKAmf-CY0aE1bFYPwD0tXJxXpaaDgfuXcHWLCR531vIFkxli1aQuLyOndETBtY367bHEpzmiWzWPwhNfSL3TAcWidMZ3VQSHwpYe9CGWyWY2yY2k97tPtBqbV10NotblxFJag6vwsmZJ_YGMGN6fKBq91STpSCfZUurUMj8qw3GQfcfEckD_2VLQmlLqVwCz-D1cXa-79NXO-B82PTeR4nIXmsK16EksjqsePS5kf-wQHTGfg2pwZU8JyDSnNuB70cOMdl8Uo6ppB-SKK2ROSDNLqrC6p4hTGS97J71dcEK4kuvAMIRQdhpgpd2Bqt81cBnc_DhYXFuR9ui_ck0z8yrO6E4QsdG4dNPOstWieVn06wtpNsIOH33gOMywoI7p6PJ4ewmhJo8kLEVB2nhbGEdAhrA5AGjmxhDaA1TK-JGG-jdQNYcmdgm2244_poOP7mAnsb1jrrzPtWQMseTpsHSFxQn0gBuf58YbLf3apM894M9O0ogZ4NpcHg5u8nbP-7PKjmEK9n6b17qYAgQIQoqIl99mOXHI08bgbWe01ctVOPrFjiMchGyWexIu2kQ3VFEF4BwwA7EKd4OgiJFnyfvL6elN5jtS2w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=2899310444873&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.135.164 St. Ingbert, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b2dbef1a8a9d94d6248c65ee5e0c258d66620c45d27e8a4956052bb676bd418c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 18540500016874104444994012521015
Connection: close
Content-Length: 1355
Expires: Mon, 27 Nov 2023 06:00:48 +0100

Redirect headers

Pragma: no-cache
Date: Mon, 27 Nov 2023 06:00:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c0e6865111&subid=&uid=022afca568fd034e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoktJjzBkZfa7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0Cj_4MfMx5hc1jcRRv7J1CImTokLVlsA2HXYHRDNdv8kp3uRUCW49nIG1hfjFbFblgMNJcbsEg5tXGoOxTapq2IAyJC8Bt3haNLT9YtHXHRvyYbxngnypTT7E7p1sr1GHwpv5_XNAWga7O2olgE4_jqZdhWDhuWW6qFTiK2cFnuJXtnlVTCPBhP1kO77Nv7XXrXzfqe581x6obVa_AHMkA8nqX3X0ap2emUaJlY43ZNMX67NgUCXEMhkFiCfr25yCI5BC6gYrziH1sa72EXWsK3AW54_Rad4g1r2ytRjTtM1WGbblzeHVSEABeXC1DTDZCPD1W1VAj-JsCU8ooGdAlGcPwm81r7agsKun94vh_QTTNzt80D9aHWVwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIg4v1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_0hDwJNY33lqT9ob2Nc13CMBgKtpg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DNKfAv-jd615doY0watjNXP3SID06eE_azra4kZ45JtJsBn_5tMVg3Fi71svarXgMo2nFNBX8MIipevXinU_CCY9wLtkCQ7X-QagH-y04bxw9EOKqBXjsPnmv7tej1N4X44dmVuftsVigZxXhsDJzxBj7vL7QHY1__2scoPQKafaokMFs%26cry%3D1%26dbm_d%3DAKAmf-CY0aE1bFYPwD0tXJxXpaaDgfuXcHWLCR531vIFkxli1aQuLyOndETBtY367bHEpzmiWzWPwhNfSL3TAcWidMZ3VQSHwpYe9CGWyWY2yY2k97tPtBqbV10NotblxFJag6vwsmZJ_YGMGN6fKBq91STpSCfZUurUMj8qw3GQfcfEckD_2VLQmlLqVwCz-D1cXa-79NXO-B82PTeR4nIXmsK16EksjqsePS5kf-wQHTGfg2pwZU8JyDSnNuB70cOMdl8Uo6ppB-SKK2ROSDNLqrC6p4hTGS97J71dcEK4kuvAMIRQdhpgpd2Bqt81cBnc_DhYXFuR9ui_ck0z8yrO6E4QsdG4dNPOstWieVn06wtpNsIOH33gOMywoI7p6PJ4ewmhJo8kLEVB2nhbGEdAhrA5AGjmxhDaA1TK-JGG-jdQNYcmdgm2244_poOP7mAnsb1jrrzPtWQMseTpsHSFxQn0gBuf58YbLf3apM894M9O0ogZ4NpcHg5u8nbP-7PKjmEK9n6b17qYAgQIQoqIl99mOXHI08bgbWe01ctVOPrFjiMchGyWexIu2kQ3VFEF4BwwA7EKd4OgiJFnyfvL6elN5jtS2w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=2899310444873&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Mon, 27 Nov 2023 06:00:48 +0100

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 8186 38 KB
13 KB 8ms
7ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 135757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 51CF 41 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CKKKRCJEJGWC4Mv1twgWb8iPzQ9BgFLYIOlcHUNRjPNBaHaUwrZwJqZjBRK24ZFKcPiHtpdx7IooK62Yb5zUInj1wK9FTntmtYXJlCt_1yNM3OJ7CYw-xMEHAh2IUZzao7abYwsmJ8u6iW7F6WHW2QK6rcrx-cTfn6RXwvcysbyUH_5DE&cry=1&dbm_d=AKAmf-DDtWOcWJXQollDr-tsrIxZl5NAm0KdfLupYNZD_HBspAfCSuQ5FYcEA5bjQDKmsrc3E2Ots8vNwePUpCz6n99ZOIYdfE1_R0EzZmW_PbJdibiGGpVf4bXl3-Cf9njnIWM_E_RhHbUTIU81hJw_XKCo4lDP8NuWYHiA9ApQWZrILOAXF2I4YwvQ0myQ48M9YlEh4XkOhFMeXqWMacSRfuZurgA4jwmlx1-LXB9QoKWaISeQDynzL8oK551ijtRls9iLhk3jJlnv47IP8JTjadtuyXG82xl4gJ16CW4uOIU78KEmesynSoD7BfU7IlGvr2wxhsg8RzIUQ0x9N800eDPE-FgI4ixlOWqqoxb9xnoVhZn2cfB8e3k5yLpQ4bwsHEIsOKMg7jubXBsmqhCYgWcba2XIK_evLsaJI6IFbkBLtyF6ANIe5dxIEWwBwb-f0-PCgIYjZWoQn-F5TXq1nJhXzTc_3wTBBTVzDgO320vqpEOdqbrWltAHN81pApvrkO4eGvF2baeIb8e9pKEdOVJ6g2vKxgOO0d2SLOo6r7bBPmaHlROEWq7HA27Sa9nobYedgAqAOBZszpsGChf2WyXkWh6n2Hu6onMA92bdNvh94Q1fDtCLWr76vcX2sMEnKO06axddoGl5f-CflUp3R84GgA2e3XyeUQYsUtX7tE8CzWArtOhp5DDz-ZJ16BPA1CNlOkCuRMM6ca4WEh2mF8lePd8jmla1aII4Ian5eXt6Toys0qES0E9dZ1MHIKTRXzsM7Hf5D2m21OuH2FvlFvhUgq_drz1NNCrtJY6Vlz7ptsH4qdVhhcYMJPTJOsMRWKNCVlW8yQuhlB_1vjzNR4wUlSEgFy6inoZv8xHUs9nPckSNBnPv3_fy7c6HbPw0-_cfxjQVTtrgqekwflzFddpOZwZOaHSUiJk16wkLvF3h_ZgSi04Qkp3CPsgm64kiVoauAn5m0rhGc1djMyjncxsKAxHhAuoCEMvcTIi9IvkzpVa75kMW0QYpUa_M_gLrQO7rjt05WKJzf5ZDRXvEWH-anov9YMOhY2KM1_4A5YgTmI5CzxPQemEY7ScmtFEAz6YN6LidwK-WtlU7DJB1oQN-uyG2Kih6l7-E5tRf8_oOyRh_TlyFqtvHpHOqqvHYdrWR2GORfqn9FCuWQsnl7NAFKmkgHsdprtJIAffQKwFPp409w4Y3d35VZTX4P0jVMqzWMKEror-_Zk6R9SmAT1t9Gk2Oenf6xeJyuHy6omiWlJhbjNlRzKfZVD_AiXBZVxi19MsmjHxHXmXql33W2u4UcjvbsoKhFbGCzR2PwuFou_n5Hg6uLl231hRBwCMisQyUaU1luOUfVPgkHBFAkn-eSMroOYdREl3sg7vtjTU7rCp_1GKvxaxNBfUjeDTxZt_zuEdwQAiMLl88X5ZNnMUNUvBErXfJw5sG7iK-mDhFi8WvD9iAOMpOF57y7qcTrhV3H8JCFcwR_dPyN9UK3YizLQfXzrbJSMN6Ds-8MVCVX-lkTYC8PHxUQiAK_-a-FYt05U3wSrfuPGz0J-ZUYAqZG-MdfLibJdUgvBMn0z4gvU7tqJgL1aBloM4-EDpTUWf4HlzWGPz_tydrULZiTvYKKaBN9CdSHhYY6pirs9vGcKtRiGACRD5l1naq4YizrhOAmMz01Lfeuyk3ruYKkzDSl1bryg1MUAyfOtcAf4q6eNENcd7CNyVKi1c4RaTV-4P6LEol6M5bS7zMurWNEN85D8sxnRCANRHIDOSBhMhkZ2smM2_cA8HIB2RyI7S8SPDxXmU2D9Ou1mNEu-Ww8XDfcveEkLwS8tKpxO_y1Up3T6pVpiukNGrbOJM5FE7hXruHRTMrlumZKNYL9HN3nU0N4BA8K247mgCqCVrEJa5MPqWCkorDbwsVR05Gn2SQd1Sm4RuWTYF5nAZuTmYdLJWJQFd0JgTeveli4YptJsKaMbKHnMcW-HrUsWDbCXUbG1SZ4h7PgRJ0S6u9yK-q63YRz3whpsphzvBJ17vMEAJK4A0HI_68CKDS_Rjte5uyvmIBXMA-W1lzNMJh1eerOdLOYWVvjdIb5C8hHfWT_ypwyV7jwRzlD3YhTcsXj5zJ8gqt9PukAdEYt8kZ-Ko6cjtwWxbuaYqqt4uDZztP8O1rV66b1XDY6GQFAfKikcHqupAENgvePuA-SfEgqV24G-XcLc_OTWLV0448cXHxIEj5Zi9h5OaTZkP2Gq8yA27schyxellQ2XgN7EfslFew9MQtQXnWK9n7y1it-zKHPLPPsKk6jl1L035WwTMA1AMgW9UEv0szfphwON99caDE7XgRUgKadhhgHnPWcbtse-_XCIkj64ehPrU19TQQYhQx2LWTbr2pQyHEcPQvDXG3cKshVg8SYf_awS1z2ufCalHGAj4mAaL2llHC25hmHPZhAo6vcZzmA5laUjQzL-7DBPV3OaquxOkiK1QGuvHPtmmVuyn1XcdmUFzA9VZ76wwEBor1b9YJATVXNjT-mzAGwU4gJKKylZUfLktiqi7z4zS0U_7n5QLCeCKiDlFfXAxqDv6DmueyF_Hb5ujBBKoGQrIbRJ5QQRRpkuN2IwiGvHAZjJ86PEKFRy0SM6qbTy_SUrgrRXYxmrsdF-OxYAIKxtyRcrJsHfRPWkbhJ-pajhbbrHHBhLyBPRHj3-wkmtVR-zv6isgPcwIKIfG1hHH9a_P1QW-gPsDlv25NyTr1tPddChQRazOdchcfsF0LOJTx-3vK0Y_wx3p6Y8EfuSFcDoJYQVDkLJoekBM0UAJz_YVMZZx-C98aBnE6woNGBVwAH5hDMpAs_02saWYjAr6rtA6zD56BHdz4zJhpC0O9xPUbX9m0IRUU971YSUZ2CMSzFbObMmtNqLRXDhW6Dojjuq6yQdnpZ8GPlQlbpUzfVG2o13OcPrLeVFD6JJyBZgTBpts0jHqFu21atu_xhqELkma-LPJs6OdwgEdktcXIQhq-qqULMFRYrSbwORMM9sTbiNhpLcSkE6UUsqLjc5vorGauwl0ns2E99g1t1YLfk0SJ0WeWWH64LsLamcej4tB1sjUOwLaVjDmXMWjixMDW8jzGlHmbFPiClFD5yu26-V223oaiNz8y8IJTJRn_ArFIy_nxKigNvUl_vKbBpbLDcWhwfDMkHT4rr36EAj0MNfYcykfyISXcQbSJi7-uQ4qg2iUJAwy-9WREk56KZAvXVebujNrICPoecVvgK5U9e6oE3dwbN08KO2znBinlOG6QSjkXbISng55h4zX9uklnhGc3a-cFl-dpQUroQ1hAoJvFEkrqmsWHmvMM4UYHiH7nF0wvbdx2fGmj7KuLe2bhIJ5Lh377Owgf980_AfVISZpwqPsH5JiphSadGypqP-6PzXUzaUiY-kmhS_52tzfbObcHRI5LbrXfU9iOKUULmQqATba6UKafly-eTlMXmaK-H_G1QLijlpQtY4Z6DvRktD3ENV0RprYwcseJhP6eVAStHZqrNz857Lo0TWN7khyrzpj5u22WJCGJh4cW5gT3mPZvRRMZB718RcNZJg5N8DROTqqPRZnLpXRrAivslfep3j_CZ621LVemm35yzIqZo0UGtxV6Jxvyg7CaXfAlbdgZqn9-9vfH7h_cgX4YlcnPwJ7IZIxcVyqxZibG2poMQCbE3DUWx59dw9Ff4JAd--gal_7baO3qhxm5px2x7hiYfg7BnAeFdf9PWtUcWrJ5-brgHFaSsD8qmQF3TG7hOPKcTwAk7hwE1z7MDbxmLlvTOE51NXUp_LqBk2SWxJ22bsIPiDica39_R1wgfkvWJPryk0KJQYge0oJcChbsDsf-8x6jnEWk7B5k2Y7T57eBd8em9iLMwPFPefwDOVtCFWFn63wEu6lLHzz9A21xyrTpaFey72CH9OugnXA8wKJGoIhTy7ZSyKiAKYIOGSOnelPIWp8b4YbWLKh-ohNQ6SCdOmqY88bHBOJITpDxtg2i_HjGGNnW5N6oYX2kLzubNOEOJtFwnSGpqg-lp1WrSCjKzkmsyHJ-pn7Kk0JmeuMk3ZQEgaaZ1w&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&dc_eid=31079496&dv3_ver=m202311060101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=11199176347821187000&adk=4188270525&idt=170&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 135806
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTA2NDg0ODQ5NDUzOAogIHNlcnZlcl9pcDogMTM1MzkzODk1CiAgcHJvY2Vzc19pZDogMzQ1NjM5MTk1Ngp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 51CF 0
496 B 47ms
46ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTA2NDg0ODQ5NDUzOAogIHNlcnZlcl9pcDogMTM1MzkzODk1CiAgcHJvY2Vzc19pZDogMzQ1NjM5MTk1Ngp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxOTU1OTMzMjQyMjkyODIzNjYxCmRlYnVnX2tleTogNTcyNzcyNDI0NjUxMDUwMDE1NgppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTEtMjciCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjE3NDg0OQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjA2OTY5CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xad964c27750e5af00000000000000000","13":"0x5b4f4b2e9b54cbca0000000000000000","14":"0x5bb5f990ba5c9ac80000000000000000","15":"0x6a9585608b31f0110000000000000000"},"debug_key":"5727724246510500156","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"1955933242292823661"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 5zyrr3xpcfb3 Show response
hal9000.redintelligence.net/zone/ Frame 51CF 12 KB
4 KB 22ms
8ms Script
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/5zyrr3xpcfb3?subid=&gdpr=&gdpr_consent=&rnd=1701064847761336&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrLQ8jzBkZfi7LvvH7_UPkIWC2A2m5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0EmFhMOV1H1OvQba12zBQnkDoWbhrBliEKkgBIhBNBSQxTh2KSD75155RL-tHpSopPLMmlwuqhI57grAu4DYH_35DhLtG-ah4oInJUJnL-R7nT6_d3X2ifQUj_xhNyphbRHbaMnjj0bfrzH8zDy8k-zJ4wAXhaUPUK-Y9AUS6U_zwEUlhyBSVv5VrwySgW30lbHGZ_aJLvid_ccjAJWF8mOvLupcOMZ1GNNgzf4N0ilj1adB__sZmV1BOnYDi1d33j31flER6P9TG9LMhInBL07SrCKIvwewO1QuD2svkb8oJ4aRDeg9jffpAvT-uXLgH3WaSCFKdgSN8Jy1WzrFMAyU1wwcERIYmgUKsG4jTFsBzulIaxOnynbABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiFi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_1eroY1zKr534v6kATicRALl8h8OQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CdT69-Q9L8T0MfIelRane0OPzhzMM8e-RUofkou6l8Vjo9wBLIkzHdlkcsqTk8C-G6Il3BufY3chnyQFbWmWvqgck8l7EI61McMKmchL68OH1eM-Lr1OLQsv0vtJXVBmMFHydk2d1ye6SCgaZp-_8gi1q-9gaMgZJ1iOZL4_ps-tkGPMA%26cry%3D1%26dbm_d%3DAKAmf-CoIsMIdueEDMY_KREry_w2cxiDtXHP1e41yZcNo9DembfPt3gHbpsjqwxyHr-Fa5JG5Diq-gbWQQuHYgNUKsToPegEc7JBy1KAT18g-pXANFjUqJYUjyOdmHSCWe9X8HDTj24l2xZdGvwXVJsweiAzicCbuo_Bq7NvQfOmktWkPGzs1VMO259Vk9iCcaQKtsb99x3sgiH2ocopGdxP_zP0fTvoptj-mjc5iMIgiw8xEQeF3ENv0RGDbcCC7-S0cFMFftaTnrSyMxP7w9F2lCGPo1MxZ9JylPsL0wtk2Sk05T7x_8bdvijwhxw968WEf6WwHuX8uL88S8AeSacgVj1s9u-8xULCj1YJ7QnORuXkiM2NImB-asf3FSF__7qyGqrZ15fCvTRCV32N_N_JE5Qhx6CmGdDPCG-B_WFjEcktTv_DFMGppVNl0CyNFn9shliTPwZvPU_29J7AwBB1NC6hCiKXccDPVOcGx4z8224x-Nd23n82YMN9p2Wjvq7k8Scb6Iv4BEwbe3V9iqYK2KtKi-OrrV2e6Pq7o5QP2vgS-layMGcP5tMydm4nT5qjb95sGbvtLY_YemoopuI4PlmvoDGQ8w%26adurl%3D
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 7bbbd1269819035f1c15b4bfac9319604220794dc09d7814e4a9c5ae3e7cc81b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4277
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame C8DC 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71040
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Nov 2024 10:16:48 GMT

GET
H/1.1 200
OK request.php Show response
hal900017.redintelligence.net/ Frame D472 4 KB
2 KB 97ms
74ms Script
application/x-javascript 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=d40b18e6ea&subid=&uid=6db945c27cb38133&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCQ-XtjzBkZfe7LvvH7_UPkIWC2A2m5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0N8Rhx8LVBgT3Gg_AAgSjDE4EV9TixS-5vKRmnSHAulfRNflxjOO1RLl99pfza67zECQuoMB-YzKbc9Xrq94WYRHEZ44gZrFag2b-TLoBYe_W9IVN-uH6vz9L7bLCVJttKR9mswsCSNTfLu7pyfWwDbPHSQPs9az6j6t41AnjMZPPInAxloABvZbwSNpqw_N5hivx6sZwhcyL7tl0SbupTLHNs1NQz0fGfwWCWj1ExYylnt9VTfutWwexXxdPPgePHlOeR-I3fl7a23sRORsUpAjyp_fKGfLhmh13FyKiuLUYSAts3rRr4Jrgqxhes670bFWZLCzlyHccgHjgd3ROQgAK_dkBWEErwC735MFfwi-H5BScba57vHABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiEi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_2tbI4lgdp7YasAEVGaxUPbG-wByw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AJFsS2ayoozU2mSnIO9-KImvpsVo595CxkW8wMHqEc0wFzsNM-ZlHEqdoVvmXizOYgtl4jHHB9CfGyIAn-rgXkztfWy38dfZuGmu2y8l14WschxW1vEtnr71c_glxIAth0jJevZhEO4cYXcswRvVLGF8iL3qfxPLxVVwkscuiQZCCoaTY%26cry%3D1%26dbm_d%3DAKAmf-CYgChhLlYQJdmEPWLFo317otsz0IuP8X8YcRKYe7sPn7MHFQXkairwtw2rwdiPhEwNuUu39y0aiEspx6LGuCpgEvZh62CF3j-diQ_8QfChNnAIDs24VvnRe4qCBN5xrHssm_oiRtjPuuxSaLVtListSzUIU0y74_DPtd4yGv0iv-8_IggCl2nFmv-la0bs0kph0yEdX94RJ0OXkDrgpTYhXFpiBxTNXwXOQcHeEMyCTWiUn0UifSCjH-BUzIQIRkTAhH29ger-roRdX7bj8uLES-5i9Z1C-SF5CIK3UUrn0WlY1FxBs1dNWVzPnxJN0nbgStpBy-wj6nbh16LmaOu-LKqOtJWxGdHJ7daRCWiINogXnlhGgSF8jQd2F9M3Rl5JGBkoHcW61zLYFLWQIVxq8phLTxxBUgDeJxOirhYfPyw7uHCkqLJ2kSsBacRzSntnEbEnYHktovC9-bpMaKM4WM6p2DtiGMIgbTpu2Wo4BE8bE4UFYabAB7dIzStDb0tLvT6vUNxOLaY13019eMUWYJIETYUD7CisZBBO1iDvHHa4TVmfSX8YhldgOwjW2opR0RyvSZZDH_dIYePdwilYpj4dvg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6830380772995&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1701064847761335&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCQ-XtjzBkZfe7LvvH7_UPkIWC2A2m5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0N8Rhx8LVBgT3Gg_AAgSjDE4EV9TixS-5vKRmnSHAulfRNflxjOO1RLl99pfza67zECQuoMB-YzKbc9Xrq94WYRHEZ44gZrFag2b-TLoBYe_W9IVN-uH6vz9L7bLCVJttKR9mswsCSNTfLu7pyfWwDbPHSQPs9az6j6t41AnjMZPPInAxloABvZbwSNpqw_N5hivx6sZwhcyL7tl0SbupTLHNs1NQz0fGfwWCWj1ExYylnt9VTfutWwexXxdPPgePHlOeR-I3fl7a23sRORsUpAjyp_fKGfLhmh13FyKiuLUYSAts3rRr4Jrgqxhes670bFWZLCzlyHccgHjgd3ROQgAK_dkBWEErwC735MFfwi-H5BScba57vHABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiEi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_2tbI4lgdp7YasAEVGaxUPbG-wByw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AJFsS2ayoozU2mSnIO9-KImvpsVo595CxkW8wMHqEc0wFzsNM-ZlHEqdoVvmXizOYgtl4jHHB9CfGyIAn-rgXkztfWy38dfZuGmu2y8l14WschxW1vEtnr71c_glxIAth0jJevZhEO4cYXcswRvVLGF8iL3qfxPLxVVwkscuiQZCCoaTY%26cry%3D1%26dbm_d%3DAKAmf-CYgChhLlYQJdmEPWLFo317otsz0IuP8X8YcRKYe7sPn7MHFQXkairwtw2rwdiPhEwNuUu39y0aiEspx6LGuCpgEvZh62CF3j-diQ_8QfChNnAIDs24VvnRe4qCBN5xrHssm_oiRtjPuuxSaLVtListSzUIU0y74_DPtd4yGv0iv-8_IggCl2nFmv-la0bs0kph0yEdX94RJ0OXkDrgpTYhXFpiBxTNXwXOQcHeEMyCTWiUn0UifSCjH-BUzIQIRkTAhH29ger-roRdX7bj8uLES-5i9Z1C-SF5CIK3UUrn0WlY1FxBs1dNWVzPnxJN0nbgStpBy-wj6nbh16LmaOu-LKqOtJWxGdHJ7daRCWiINogXnlhGgSF8jQd2F9M3Rl5JGBkoHcW61zLYFLWQIVxq8phLTxxBUgDeJxOirhYfPyw7uHCkqLJ2kSsBacRzSntnEbEnYHktovC9-bpMaKM4WM6p2DtiGMIgbTpu2Wo4BE8bE4UFYabAB7dIzStDb0tLvT6vUNxOLaY13019eMUWYJIETYUD7CisZBBO1iDvHHa4TVmfSX8YhldgOwjW2opR0RyvSZZDH_dIYePdwilYpj4dvg%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: 4d940ce42274f3a82e4d0c90b49984b5c9646a0fb0afef8efbf00f074fbca915

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 71561800017758104444550012521017
Connection: close
Content-Length: 1318
Expires: Mon, 27 Nov 2023 06:00:48 +0100

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 8186 39 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71040
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Nov 2024 10:16:48 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 1F23 38 KB
13 KB 9ms
8ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 135757
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request.php Show response
hal900017.redintelligence.net/ Frame 51CF 4 KB
2 KB 88ms
75ms Script
application/x-javascript 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=9aca3c0780&subid=&uid=c8607bc1aecd2229&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrLQ8jzBkZfi7LvvH7_UPkIWC2A2m5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0EmFhMOV1H1OvQba12zBQnkDoWbhrBliEKkgBIhBNBSQxTh2KSD75155RL-tHpSopPLMmlwuqhI57grAu4DYH_35DhLtG-ah4oInJUJnL-R7nT6_d3X2ifQUj_xhNyphbRHbaMnjj0bfrzH8zDy8k-zJ4wAXhaUPUK-Y9AUS6U_zwEUlhyBSVv5VrwySgW30lbHGZ_aJLvid_ccjAJWF8mOvLupcOMZ1GNNgzf4N0ilj1adB__sZmV1BOnYDi1d33j31flER6P9TG9LMhInBL07SrCKIvwewO1QuD2svkb8oJ4aRDeg9jffpAvT-uXLgH3WaSCFKdgSN8Jy1WzrFMAyU1wwcERIYmgUKsG4jTFsBzulIaxOnynbABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiFi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_1eroY1zKr534v6kATicRALl8h8OQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CdT69-Q9L8T0MfIelRane0OPzhzMM8e-RUofkou6l8Vjo9wBLIkzHdlkcsqTk8C-G6Il3BufY3chnyQFbWmWvqgck8l7EI61McMKmchL68OH1eM-Lr1OLQsv0vtJXVBmMFHydk2d1ye6SCgaZp-_8gi1q-9gaMgZJ1iOZL4_ps-tkGPMA%26cry%3D1%26dbm_d%3DAKAmf-CoIsMIdueEDMY_KREry_w2cxiDtXHP1e41yZcNo9DembfPt3gHbpsjqwxyHr-Fa5JG5Diq-gbWQQuHYgNUKsToPegEc7JBy1KAT18g-pXANFjUqJYUjyOdmHSCWe9X8HDTj24l2xZdGvwXVJsweiAzicCbuo_Bq7NvQfOmktWkPGzs1VMO259Vk9iCcaQKtsb99x3sgiH2ocopGdxP_zP0fTvoptj-mjc5iMIgiw8xEQeF3ENv0RGDbcCC7-S0cFMFftaTnrSyMxP7w9F2lCGPo1MxZ9JylPsL0wtk2Sk05T7x_8bdvijwhxw968WEf6WwHuX8uL88S8AeSacgVj1s9u-8xULCj1YJ7QnORuXkiM2NImB-asf3FSF__7qyGqrZ15fCvTRCV32N_N_JE5Qhx6CmGdDPCG-B_WFjEcktTv_DFMGppVNl0CyNFn9shliTPwZvPU_29J7AwBB1NC6hCiKXccDPVOcGx4z8224x-Nd23n82YMN9p2Wjvq7k8Scb6Iv4BEwbe3V9iqYK2KtKi-OrrV2e6Pq7o5QP2vgS-layMGcP5tMydm4nT5qjb95sGbvtLY_YemoopuI4PlmvoDGQ8w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8747164467189&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/5zyrr3xpcfb3?subid=&gdpr=&gdpr_consent=&rnd=1701064847761336&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrLQ8jzBkZfi7LvvH7_UPkIWC2A2m5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0EmFhMOV1H1OvQba12zBQnkDoWbhrBliEKkgBIhBNBSQxTh2KSD75155RL-tHpSopPLMmlwuqhI57grAu4DYH_35DhLtG-ah4oInJUJnL-R7nT6_d3X2ifQUj_xhNyphbRHbaMnjj0bfrzH8zDy8k-zJ4wAXhaUPUK-Y9AUS6U_zwEUlhyBSVv5VrwySgW30lbHGZ_aJLvid_ccjAJWF8mOvLupcOMZ1GNNgzf4N0ilj1adB__sZmV1BOnYDi1d33j31flER6P9TG9LMhInBL07SrCKIvwewO1QuD2svkb8oJ4aRDeg9jffpAvT-uXLgH3WaSCFKdgSN8Jy1WzrFMAyU1wwcERIYmgUKsG4jTFsBzulIaxOnynbABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiFi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_1eroY1zKr534v6kATicRALl8h8OQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CdT69-Q9L8T0MfIelRane0OPzhzMM8e-RUofkou6l8Vjo9wBLIkzHdlkcsqTk8C-G6Il3BufY3chnyQFbWmWvqgck8l7EI61McMKmchL68OH1eM-Lr1OLQsv0vtJXVBmMFHydk2d1ye6SCgaZp-_8gi1q-9gaMgZJ1iOZL4_ps-tkGPMA%26cry%3D1%26dbm_d%3DAKAmf-CoIsMIdueEDMY_KREry_w2cxiDtXHP1e41yZcNo9DembfPt3gHbpsjqwxyHr-Fa5JG5Diq-gbWQQuHYgNUKsToPegEc7JBy1KAT18g-pXANFjUqJYUjyOdmHSCWe9X8HDTj24l2xZdGvwXVJsweiAzicCbuo_Bq7NvQfOmktWkPGzs1VMO259Vk9iCcaQKtsb99x3sgiH2ocopGdxP_zP0fTvoptj-mjc5iMIgiw8xEQeF3ENv0RGDbcCC7-S0cFMFftaTnrSyMxP7w9F2lCGPo1MxZ9JylPsL0wtk2Sk05T7x_8bdvijwhxw968WEf6WwHuX8uL88S8AeSacgVj1s9u-8xULCj1YJ7QnORuXkiM2NImB-asf3FSF__7qyGqrZ15fCvTRCV32N_N_JE5Qhx6CmGdDPCG-B_WFjEcktTv_DFMGppVNl0CyNFn9shliTPwZvPU_29J7AwBB1NC6hCiKXccDPVOcGx4z8224x-Nd23n82YMN9p2Wjvq7k8Scb6Iv4BEwbe3V9iqYK2KtKi-OrrV2e6Pq7o5QP2vgS-layMGcP5tMydm4nT5qjb95sGbvtLY_YemoopuI4PlmvoDGQ8w%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: 12c98ec6b7331dac82f5f77f42fbc5d0c2e4dda71137c30953546b9b105e2e33

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 88729800017758304445002012521017
Connection: close
Content-Length: 1323
Expires: Mon, 27 Nov 2023 06:00:48 +0100

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 105ms
105ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c82727aca96931-FRA
date: Mon, 27 Nov 2023 06:00:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0SXXlo%2FKgT3x4enZosJHbEIRnsgrZPaRjKO7R5Z%2FYZcbPZ1qcIBQ3LnJVtRsuT4beUNLmVQKsU2sn9vmAhNtH1qm7mJJBO1XwWkqwk6W6KxxNMPYDyhoHmRwASZD7bEznDSHjAImHYjsvGcWnqc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
287 B 114ms
112ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F%2BQN8xtrlU%2Bayci1DtFdRka65XglNrqpelLqr3sdmqqEGLGGKNi8TeTvMqYTT8p3%2F6N7qDN0dHRxh8i8k%2BxqHBgghPMzxeI6k0GCJuzlgc0u0wvPdP8TyWxHlLegA%2FEKDswXe1gSc9SsHipwfQk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c827285d386931-FRA
content-length: 0

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 1F23 39 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71040
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Nov 2024 10:16:48 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3873 0
20 B 46ms
45ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B2cOjkDBkZYOQGfHG7_UP59i9wAcAAAAAOAHgBAI&bg=!OTqlOnXNAAZxrfrxUa07ADQBe5WfOMNokblzcZSGwFYASNZQti_F62VqYCKyXfuAyC4csIhk86fot1dH3mPOUHkyIYngAgAAAFBSAAAAAWgBBwoAeQf5IVmhkAGJ_Hrx78ucr4AuiJTIdce18kUTk684PTjP9Sguiba7gBTzEkYqEdmV8bduwk_kBMTAbnGbo4cDRd8obYHrrw_LyC6QAYJkMq3XBPQoDF0yxUtI0sdhBthQi6WDgI9feVNbmj8oeAzvayHEFQyas_3z4aiZAxBlGI97sde3N7m_nm1hiblEXu06HFJDLhTeI8Qhl5Gg9ZpqlMDY5snNoGsQdfJ59LWNvhCwmIYcdpzpS31a4BGVZojD-aRetBbACZcZyXV_j5oJ4a8dqCz8iMlqvvdPUqYou9goYAy4Ux3OrwHXS1HZNAK6lSvuJ14frREVwqBuUrGg5Yy3rnsPI253am0fojuVScSD2TCuVlD2Fq3ghe_iVGhaEdp344JNJohYo3jLsSrR5mlKYsgRBC0RQ9nW5g7bgGOC7-v48AhOu1cdzFNVgdOSV4PxQo_pJczGHkNIcIElDBdo6FlzFe32awx88nORwRPgNyE_ZBZFF-NDr3t0Rdq8hPwzltIJX2VLxbgcLv9ittHsQbhyVv4u0UYyE0JDsq7xKHBtUtHVwOc7QPoZbANX1VLYHiqnrNbhUpLhfhqxECx42jP8bePPhdiG99sYYI7w-J4DLTQlGtNyk9ZkaHW7ESEys8zhyh7ixZOgB0Xs1_040UPHhlite4TY_7P-zYWq55s4911awZIPhgfe4SfXqheQrNhbEIA_u8fFNtJmsvzR_voGlmU4IZLf63N13lbIOHgZ5xbheO7H_2r-RxnDIYsCIt235blu_5i5IOYpsasOiS-hsLS-vweHA9gD_5gwaAIu94qzFwJispMRsevG5PVJw6Z-guh95b9Hz3eYDRrW-uiFQ0o0DtrDsEO3CfPiI5mpi6eCRPffhD8R28CzE76twHmr3XiWzyFbczwWX3sywQZRhQKsm4eHTsgA2ZxlT2GWGfndfzqZxNwVJNTj6ONZ_wtqM-0AV9N6eslK0S67P_irNCrsYXMigF8eRz9GBn-fgIL9oMZaIq83LIGGg0xCCtX_T_JAxB2LvF_cTUpE7SO4G6SQMMt2630RCs1hyaunkkj6sjDo0R-Oa7fcOGSdxlkXkzfrul-OQ-CGF2y_CjvK84SJmQbGBeIe7eI2mImOwQyJ348Krtqtc_QLRfuDUJTxF1uDlSxxT0fVyGwcpZckLaQk8Yfx1S27xESco3da6HdObzvBWnrZ

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

htlp Show response
futalis.de/ Frame 858B
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=78339700016663304444994012521006&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252217

350 B
401 B

39ms
8ms

Document
text/html

49.12.16.151
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252217
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8690c50e58&subid=&uid=97371124d3684856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1LDAjzBkZfW7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0MU-lM10t4m1xlK7VZBS18QGnruppF7r_nYuPmgUvInyXnj2Py5TF2BMvzAkJsCNDYuchV8cMlmHmd8wpeNhA6mKvT2n9nA7APTq-X2pp8rTPsMAOrU3lsg8S9C1Qw-Q8Dv-JEA3Lij6mDOdRNHNIgyCK4GWYvdudeVI4y0vHy4BIrft0yeBzQ7Qz5uUVoC8iv1TE_MqV-Or8M6NOgTc-it1id8V0yQv0h5bwe4sO3K8XDXa_DmJaaAjTomFRy7lIXQa1vXIUs2T6dFzTTuF-PL3seiR-cNySjEA0BHZLIi7btjrK2sK4eCRdmjLfJYR5bXhx3h7QmU2RT8V63go4N5qWRtunvwFCtnUkJqxZz1gzp864aUNCmPzwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIgov1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_3_6s4h2vDJLwTJ6ReFGSVbrW8MrQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BqhbjuSIU49eYlurqmIHrQz5a2jH2hnHOuzU1mpt7hz2q4wskcnwXsviePanswRSd0xR4Q3Ynz8IPZrq4igJkuAxevdBUNLVMBndHLSv8pxu7Idq5TFJk6BAO_DbbZ9cz76mdTPaF-Gyh8SEjGQ613dAUdRu_YcY8aMo61z3_mol5-OnU%26cry%3D1%26dbm_d%3DAKAmf-AXIJYwUvvt8ixpj9evsYDD4eFSMpwIydxY8INUxBsrfL1LvrRMxTqnvCkqs24eGcszSlKFE0ULzK9gWfcNwMVKxsHkMpl8IBT_ZfjdlmNtryeIT8W428vK4u8fTnOoFYKSaRP9qqt8aPhgjO--0FZx_xnnKO0sSrLlwNbbhJKM3O9e5vMDZH50poWXfJIj-K9CONNQn3CHNKIM3RVYqKOHIjYgmg2rGl8WMENqXV7ocy8QEJbNNwvpZL1lgzm74uUZCPJgrBHMkMSl6X3vUpwQ6SoSuLsEBMOLpc6iBrTlB_p8dK4IyEKe4mJYWG2tOwIiynz-9On_A7Sd0YyliSfjeJUe0L3rej6xGZOL-PScwircxAgtyDCuDs_6QJNB1vs2GRV6Q4iWWVsXf2cf_rFMSmUQX_UsM519uBgNzoQwfg9r9nJcedau3hClwzOuciakNILS-jb4k53Y-KWnT84qrAkNp8EysCueABMMycw7zn1pIQ213z10luMEcdTIIRNGer30lSFA4Xol3cgvTtw7rT6AajU5cTR77PfYq_RlE4KxE4y51ABQd9JSSlPnwbZkLRxAFGpg--Y4LOQVtBCv0LkTwg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6228476358046&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 49.12.16.151 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-1.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Mon, 27 Nov 2023 06:00:48 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252217
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame B4A5
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=78339700016663304444994012521006&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=78339700016663304444994012521006&actionid=879111&produktid=ratenkredit&dt_url=

0
628 B

63ms
31ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=78339700016663304444994012521006&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8690c50e58&subid=&uid=97371124d3684856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1LDAjzBkZfW7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0MU-lM10t4m1xlK7VZBS18QGnruppF7r_nYuPmgUvInyXnj2Py5TF2BMvzAkJsCNDYuchV8cMlmHmd8wpeNhA6mKvT2n9nA7APTq-X2pp8rTPsMAOrU3lsg8S9C1Qw-Q8Dv-JEA3Lij6mDOdRNHNIgyCK4GWYvdudeVI4y0vHy4BIrft0yeBzQ7Qz5uUVoC8iv1TE_MqV-Or8M6NOgTc-it1id8V0yQv0h5bwe4sO3K8XDXa_DmJaaAjTomFRy7lIXQa1vXIUs2T6dFzTTuF-PL3seiR-cNySjEA0BHZLIi7btjrK2sK4eCRdmjLfJYR5bXhx3h7QmU2RT8V63go4N5qWRtunvwFCtnUkJqxZz1gzp864aUNCmPzwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIgov1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_3_6s4h2vDJLwTJ6ReFGSVbrW8MrQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BqhbjuSIU49eYlurqmIHrQz5a2jH2hnHOuzU1mpt7hz2q4wskcnwXsviePanswRSd0xR4Q3Ynz8IPZrq4igJkuAxevdBUNLVMBndHLSv8pxu7Idq5TFJk6BAO_DbbZ9cz76mdTPaF-Gyh8SEjGQ613dAUdRu_YcY8aMo61z3_mol5-OnU%26cry%3D1%26dbm_d%3DAKAmf-AXIJYwUvvt8ixpj9evsYDD4eFSMpwIydxY8INUxBsrfL1LvrRMxTqnvCkqs24eGcszSlKFE0ULzK9gWfcNwMVKxsHkMpl8IBT_ZfjdlmNtryeIT8W428vK4u8fTnOoFYKSaRP9qqt8aPhgjO--0FZx_xnnKO0sSrLlwNbbhJKM3O9e5vMDZH50poWXfJIj-K9CONNQn3CHNKIM3RVYqKOHIjYgmg2rGl8WMENqXV7ocy8QEJbNNwvpZL1lgzm74uUZCPJgrBHMkMSl6X3vUpwQ6SoSuLsEBMOLpc6iBrTlB_p8dK4IyEKe4mJYWG2tOwIiynz-9On_A7Sd0YyliSfjeJUe0L3rej6xGZOL-PScwircxAgtyDCuDs_6QJNB1vs2GRV6Q4iWWVsXf2cf_rFMSmUQX_UsM519uBgNzoQwfg9r9nJcedau3hClwzOuciakNILS-jb4k53Y-KWnT84qrAkNp8EysCueABMMycw7zn1pIQ213z10luMEcdTIIRNGer30lSFA4Xol3cgvTtw7rT6AajU5cTR77PfYq_RlE4KxE4y51ABQd9JSSlPnwbZkLRxAFGpg--Y4LOQVtBCv0LkTwg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6228476358046&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 27 Nov 2023 06:00:47 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Mon, 27 Nov 2023 07:00:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Mon, 27 Nov 2023 06:00:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=78339700016663304444994012521006&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: 515F0528:A04E_91EFC182:01BB_65643090_8058ECA:1E87A

GET
H2 200 / Show response
adv.office-partner.de/ Frame 7FFA 930 B
923 B 52ms
6ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8690c50e58&subid=&uid=97371124d3684856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1LDAjzBkZfW7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0MU-lM10t4m1xlK7VZBS18QGnruppF7r_nYuPmgUvInyXnj2Py5TF2BMvzAkJsCNDYuchV8cMlmHmd8wpeNhA6mKvT2n9nA7APTq-X2pp8rTPsMAOrU3lsg8S9C1Qw-Q8Dv-JEA3Lij6mDOdRNHNIgyCK4GWYvdudeVI4y0vHy4BIrft0yeBzQ7Qz5uUVoC8iv1TE_MqV-Or8M6NOgTc-it1id8V0yQv0h5bwe4sO3K8XDXa_DmJaaAjTomFRy7lIXQa1vXIUs2T6dFzTTuF-PL3seiR-cNySjEA0BHZLIi7btjrK2sK4eCRdmjLfJYR5bXhx3h7QmU2RT8V63go4N5qWRtunvwFCtnUkJqxZz1gzp864aUNCmPzwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIgov1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_3_6s4h2vDJLwTJ6ReFGSVbrW8MrQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BqhbjuSIU49eYlurqmIHrQz5a2jH2hnHOuzU1mpt7hz2q4wskcnwXsviePanswRSd0xR4Q3Ynz8IPZrq4igJkuAxevdBUNLVMBndHLSv8pxu7Idq5TFJk6BAO_DbbZ9cz76mdTPaF-Gyh8SEjGQ613dAUdRu_YcY8aMo61z3_mol5-OnU%26cry%3D1%26dbm_d%3DAKAmf-AXIJYwUvvt8ixpj9evsYDD4eFSMpwIydxY8INUxBsrfL1LvrRMxTqnvCkqs24eGcszSlKFE0ULzK9gWfcNwMVKxsHkMpl8IBT_ZfjdlmNtryeIT8W428vK4u8fTnOoFYKSaRP9qqt8aPhgjO--0FZx_xnnKO0sSrLlwNbbhJKM3O9e5vMDZH50poWXfJIj-K9CONNQn3CHNKIM3RVYqKOHIjYgmg2rGl8WMENqXV7ocy8QEJbNNwvpZL1lgzm74uUZCPJgrBHMkMSl6X3vUpwQ6SoSuLsEBMOLpc6iBrTlB_p8dK4IyEKe4mJYWG2tOwIiynz-9On_A7Sd0YyliSfjeJUe0L3rej6xGZOL-PScwircxAgtyDCuDs_6QJNB1vs2GRV6Q4iWWVsXf2cf_rFMSmUQX_UsM519uBgNzoQwfg9r9nJcedau3hClwzOuciakNILS-jb4k53Y-KWnT84qrAkNp8EysCueABMMycw7zn1pIQ213z10luMEcdTIIRNGer30lSFA4Xol3cgvTtw7rT6AajU5cTR77PfYq_RlE4KxE4y51ABQd9JSSlPnwbZkLRxAFGpg--Y4LOQVtBCv0LkTwg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6228476358046&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Mon, 27 Nov 2023 06:00:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Mon, 04 Dec 2023 06:00:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 0090 2 KB
2 KB 150ms
80ms Script
text/html 3.11.123.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=78339700016663304444994012521006&nw=1
Requested by: Host: vodafoneidea.ph
URL: http://vodafoneidea.ph/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.123.127 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-123-127.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 857bf39f8f2ef9e0d0a105182ba62948abc2a9e11d7547736c356350393fe863

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
last-modified: Mon, 27 Nov 2023 06:00:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Mon, 27 Nov 2023 06:01:48 GMT

GET
H2

200

activityi;dc_pre=CKzfr7DA44IDFbFKkQUdBLAHeg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4494157273102.517 Show response
5994599.fls.doubleclick.net/ Frame CAF9
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4494157273102.517?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CKzfr7DA44IDFbFKkQUdBLAHeg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4494157273102.517?

391 B
326 B

53ms
53ms

Document
text/html

142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CKzfr7DA44IDFbFKkQUdBLAHeg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4494157273102.517?

Requested by

Host: vodafoneidea.ph
URL: http://vodafoneidea.ph/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49c8029698ee21a1fb3bd4c0021905e7845843d138ff114228d3369a6555fe7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
expires: Mon, 27 Nov 2023 06:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CKzfr7DA44IDFbFKkQUdBLAHeg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4494157273102.517?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90006.redintelligence.net/ Frame 4597 7 KB
2 KB 21ms
8ms Document
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/request_content.php?s=78339700016663304444994012521006&a=6b04bd91
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=8690c50e58&subid=&uid=97371124d3684856&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1LDAjzBkZfW7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0MU-lM10t4m1xlK7VZBS18QGnruppF7r_nYuPmgUvInyXnj2Py5TF2BMvzAkJsCNDYuchV8cMlmHmd8wpeNhA6mKvT2n9nA7APTq-X2pp8rTPsMAOrU3lsg8S9C1Qw-Q8Dv-JEA3Lij6mDOdRNHNIgyCK4GWYvdudeVI4y0vHy4BIrft0yeBzQ7Qz5uUVoC8iv1TE_MqV-Or8M6NOgTc-it1id8V0yQv0h5bwe4sO3K8XDXa_DmJaaAjTomFRy7lIXQa1vXIUs2T6dFzTTuF-PL3seiR-cNySjEA0BHZLIi7btjrK2sK4eCRdmjLfJYR5bXhx3h7QmU2RT8V63go4N5qWRtunvwFCtnUkJqxZz1gzp864aUNCmPzwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIgov1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_3_6s4h2vDJLwTJ6ReFGSVbrW8MrQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BqhbjuSIU49eYlurqmIHrQz5a2jH2hnHOuzU1mpt7hz2q4wskcnwXsviePanswRSd0xR4Q3Ynz8IPZrq4igJkuAxevdBUNLVMBndHLSv8pxu7Idq5TFJk6BAO_DbbZ9cz76mdTPaF-Gyh8SEjGQ613dAUdRu_YcY8aMo61z3_mol5-OnU%26cry%3D1%26dbm_d%3DAKAmf-AXIJYwUvvt8ixpj9evsYDD4eFSMpwIydxY8INUxBsrfL1LvrRMxTqnvCkqs24eGcszSlKFE0ULzK9gWfcNwMVKxsHkMpl8IBT_ZfjdlmNtryeIT8W428vK4u8fTnOoFYKSaRP9qqt8aPhgjO--0FZx_xnnKO0sSrLlwNbbhJKM3O9e5vMDZH50poWXfJIj-K9CONNQn3CHNKIM3RVYqKOHIjYgmg2rGl8WMENqXV7ocy8QEJbNNwvpZL1lgzm74uUZCPJgrBHMkMSl6X3vUpwQ6SoSuLsEBMOLpc6iBrTlB_p8dK4IyEKe4mJYWG2tOwIiynz-9On_A7Sd0YyliSfjeJUe0L3rej6xGZOL-PScwircxAgtyDCuDs_6QJNB1vs2GRV6Q4iWWVsXf2cf_rFMSmUQX_UsM519uBgNzoQwfg9r9nJcedau3hClwzOuciakNILS-jb4k53Y-KWnT84qrAkNp8EysCueABMMycw7zn1pIQ213z10luMEcdTIIRNGer30lSFA4Xol3cgvTtw7rT6AajU5cTR77PfYq_RlE4KxE4y51ABQd9JSSlPnwbZkLRxAFGpg--Y4LOQVtBCv0LkTwg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6228476358046&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 6af18752ff62941ec5d3aa0a00638babf942d25751249c49aa3311a3e7d47202

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2119
Content-Type: text/html; charset=utf-8
Date: Mon, 27 Nov 2023 06:00:48 GMT
Expires: Mon, 27 Nov 2023 06:00:48 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 0090
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=78339700016663304444994012521006&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=78339700016663304444994012521006&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
666 B

114ms
74ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=78339700016663304444994012521006&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: 515F0528:A070_91EFC182:01BB_65643090_80FA639:1A42B
x-iplb-instance: 40028
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=78339700016663304444994012521006&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Mon, 27 Nov 2023 06:00:48 GMT
server: nginx
content-length: 138
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 66D3 1 KB
643 B 10ms
9ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 74133
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 09:25:15 GMT
etag: 48472445140208031
expires: Mon, 27 Nov 2023 09:25:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0090 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe1905e2a4cb4aafa079bf2504596800d63d9f34b6018445832b16cb405f6966

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 20ms
20ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 28 Nov 2023 06:00:48 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4597 5 KB
682 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=78339700016663304444994012521006&a=6b04bd91

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 04:08:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4597 13 KB
13 KB 21ms
8ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=78339700016663304444994012521006&a=6b04bd91
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: ce54602423b934e22b74d418617094c9a35690afc8bb08ef6255adb166e9e125

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12996
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4597 17 KB
17 KB 22ms
9ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=78339700016663304444994012521006&a=6b04bd91
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 9149d214e2f1e2a3ae0dc58697504d743bd677afbe7685f74ab5eb72359d97a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4597 16 KB
16 KB 23ms
8ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=78339700016663304444994012521006&a=6b04bd91
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: d92a084f754386d657e935721ef3060c78b0bed045c1eb6ce52b870b82653383

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16512
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 / Show response
adv.office-partner.de/ Frame 59AE 930 B
922 B 6ms
6ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=d40b18e6ea&subid=&uid=6db945c27cb38133&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCQ-XtjzBkZfe7LvvH7_UPkIWC2A2m5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0N8Rhx8LVBgT3Gg_AAgSjDE4EV9TixS-5vKRmnSHAulfRNflxjOO1RLl99pfza67zECQuoMB-YzKbc9Xrq94WYRHEZ44gZrFag2b-TLoBYe_W9IVN-uH6vz9L7bLCVJttKR9mswsCSNTfLu7pyfWwDbPHSQPs9az6j6t41AnjMZPPInAxloABvZbwSNpqw_N5hivx6sZwhcyL7tl0SbupTLHNs1NQz0fGfwWCWj1ExYylnt9VTfutWwexXxdPPgePHlOeR-I3fl7a23sRORsUpAjyp_fKGfLhmh13FyKiuLUYSAts3rRr4Jrgqxhes670bFWZLCzlyHccgHjgd3ROQgAK_dkBWEErwC735MFfwi-H5BScba57vHABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiEi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_2tbI4lgdp7YasAEVGaxUPbG-wByw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AJFsS2ayoozU2mSnIO9-KImvpsVo595CxkW8wMHqEc0wFzsNM-ZlHEqdoVvmXizOYgtl4jHHB9CfGyIAn-rgXkztfWy38dfZuGmu2y8l14WschxW1vEtnr71c_glxIAth0jJevZhEO4cYXcswRvVLGF8iL3qfxPLxVVwkscuiQZCCoaTY%26cry%3D1%26dbm_d%3DAKAmf-CYgChhLlYQJdmEPWLFo317otsz0IuP8X8YcRKYe7sPn7MHFQXkairwtw2rwdiPhEwNuUu39y0aiEspx6LGuCpgEvZh62CF3j-diQ_8QfChNnAIDs24VvnRe4qCBN5xrHssm_oiRtjPuuxSaLVtListSzUIU0y74_DPtd4yGv0iv-8_IggCl2nFmv-la0bs0kph0yEdX94RJ0OXkDrgpTYhXFpiBxTNXwXOQcHeEMyCTWiUn0UifSCjH-BUzIQIRkTAhH29ger-roRdX7bj8uLES-5i9Z1C-SF5CIK3UUrn0WlY1FxBs1dNWVzPnxJN0nbgStpBy-wj6nbh16LmaOu-LKqOtJWxGdHJ7daRCWiINogXnlhGgSF8jQd2F9M3Rl5JGBkoHcW61zLYFLWQIVxq8phLTxxBUgDeJxOirhYfPyw7uHCkqLJ2kSsBacRzSntnEbEnYHktovC9-bpMaKM4WM6p2DtiGMIgbTpu2Wo4BE8bE4UFYabAB7dIzStDb0tLvT6vUNxOLaY13019eMUWYJIETYUD7CisZBBO1iDvHHa4TVmfSX8YhldgOwjW2opR0RyvSZZDH_dIYePdwilYpj4dvg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6830380772995&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Mon, 27 Nov 2023 06:00:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Mon, 04 Dec 2023 06:00:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

htlp Show response
futalis.de/ Frame 4F2C
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=71561800017758104444550012521017&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252221

350 B
400 B

18ms
18ms

Document
text/html

49.12.16.151
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252221
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=d40b18e6ea&subid=&uid=6db945c27cb38133&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCQ-XtjzBkZfe7LvvH7_UPkIWC2A2m5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0N8Rhx8LVBgT3Gg_AAgSjDE4EV9TixS-5vKRmnSHAulfRNflxjOO1RLl99pfza67zECQuoMB-YzKbc9Xrq94WYRHEZ44gZrFag2b-TLoBYe_W9IVN-uH6vz9L7bLCVJttKR9mswsCSNTfLu7pyfWwDbPHSQPs9az6j6t41AnjMZPPInAxloABvZbwSNpqw_N5hivx6sZwhcyL7tl0SbupTLHNs1NQz0fGfwWCWj1ExYylnt9VTfutWwexXxdPPgePHlOeR-I3fl7a23sRORsUpAjyp_fKGfLhmh13FyKiuLUYSAts3rRr4Jrgqxhes670bFWZLCzlyHccgHjgd3ROQgAK_dkBWEErwC735MFfwi-H5BScba57vHABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiEi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_2tbI4lgdp7YasAEVGaxUPbG-wByw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AJFsS2ayoozU2mSnIO9-KImvpsVo595CxkW8wMHqEc0wFzsNM-ZlHEqdoVvmXizOYgtl4jHHB9CfGyIAn-rgXkztfWy38dfZuGmu2y8l14WschxW1vEtnr71c_glxIAth0jJevZhEO4cYXcswRvVLGF8iL3qfxPLxVVwkscuiQZCCoaTY%26cry%3D1%26dbm_d%3DAKAmf-CYgChhLlYQJdmEPWLFo317otsz0IuP8X8YcRKYe7sPn7MHFQXkairwtw2rwdiPhEwNuUu39y0aiEspx6LGuCpgEvZh62CF3j-diQ_8QfChNnAIDs24VvnRe4qCBN5xrHssm_oiRtjPuuxSaLVtListSzUIU0y74_DPtd4yGv0iv-8_IggCl2nFmv-la0bs0kph0yEdX94RJ0OXkDrgpTYhXFpiBxTNXwXOQcHeEMyCTWiUn0UifSCjH-BUzIQIRkTAhH29ger-roRdX7bj8uLES-5i9Z1C-SF5CIK3UUrn0WlY1FxBs1dNWVzPnxJN0nbgStpBy-wj6nbh16LmaOu-LKqOtJWxGdHJ7daRCWiINogXnlhGgSF8jQd2F9M3Rl5JGBkoHcW61zLYFLWQIVxq8phLTxxBUgDeJxOirhYfPyw7uHCkqLJ2kSsBacRzSntnEbEnYHktovC9-bpMaKM4WM6p2DtiGMIgbTpu2Wo4BE8bE4UFYabAB7dIzStDb0tLvT6vUNxOLaY13019eMUWYJIETYUD7CisZBBO1iDvHHa4TVmfSX8YhldgOwjW2opR0RyvSZZDH_dIYePdwilYpj4dvg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6830380772995&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 49.12.16.151 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-1.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Mon, 27 Nov 2023 06:00:48 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252221
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2 200 link.html Show response
track.webgains.com/ Frame D472 2 KB
2 KB 69ms
66ms Script
text/html 3.11.123.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=71561800017758104444550012521017&nw=1
Requested by: Host: vodafoneidea.ph
URL: http://vodafoneidea.ph/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.123.127 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-123-127.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 4805bd70881cf3b48fda62a84c3f9eb5da938b65e40d267760676212988dd706

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
last-modified: Mon, 27 Nov 2023 06:00:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Mon, 27 Nov 2023 06:01:48 GMT

GET
H3

200

activityi;dc_pre=CILasbDA44IDFT1GkQUdAjsEFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3071346376753.8027 Show response
5994599.fls.doubleclick.net/ Frame D73B
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3071346376753.8027?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CILasbDA44IDFT1GkQUdAjsEFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3071346376753.8027?

392 B
240 B

49ms
49ms

Document
text/html

142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CILasbDA44IDFT1GkQUdAjsEFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3071346376753.8027?

Requested by

Host: vodafoneidea.ph
URL: http://vodafoneidea.ph/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08db98939501147ab123da2e3cecea15e46179f153c07614dac2575b6e8137f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
expires: Mon, 27 Nov 2023 06:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CILasbDA44IDFT1GkQUdAjsEFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3071346376753.8027?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900017.redintelligence.net/ Frame 4B52 7 KB
2 KB 22ms
8ms Document
text/html 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/request_content.php?s=71561800017758104444550012521017&a=98b6eeef
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=d40b18e6ea&subid=&uid=6db945c27cb38133&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCQ-XtjzBkZfe7LvvH7_UPkIWC2A2m5b2gaYWVnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0N8Rhx8LVBgT3Gg_AAgSjDE4EV9TixS-5vKRmnSHAulfRNflxjOO1RLl99pfza67zECQuoMB-YzKbc9Xrq94WYRHEZ44gZrFag2b-TLoBYe_W9IVN-uH6vz9L7bLCVJttKR9mswsCSNTfLu7pyfWwDbPHSQPs9az6j6t41AnjMZPPInAxloABvZbwSNpqw_N5hivx6sZwhcyL7tl0SbupTLHNs1NQz0fGfwWCWj1ExYylnt9VTfutWwexXxdPPgePHlOeR-I3fl7a23sRORsUpAjyp_fKGfLhmh13FyKiuLUYSAts3rRr4Jrgqxhes670bFWZLCzlyHccgHjgd3ROQgAK_dkBWEErwC735MFfwi-H5BScba57vHABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiEi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_2tbI4lgdp7YasAEVGaxUPbG-wByw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AJFsS2ayoozU2mSnIO9-KImvpsVo595CxkW8wMHqEc0wFzsNM-ZlHEqdoVvmXizOYgtl4jHHB9CfGyIAn-rgXkztfWy38dfZuGmu2y8l14WschxW1vEtnr71c_glxIAth0jJevZhEO4cYXcswRvVLGF8iL3qfxPLxVVwkscuiQZCCoaTY%26cry%3D1%26dbm_d%3DAKAmf-CYgChhLlYQJdmEPWLFo317otsz0IuP8X8YcRKYe7sPn7MHFQXkairwtw2rwdiPhEwNuUu39y0aiEspx6LGuCpgEvZh62CF3j-diQ_8QfChNnAIDs24VvnRe4qCBN5xrHssm_oiRtjPuuxSaLVtListSzUIU0y74_DPtd4yGv0iv-8_IggCl2nFmv-la0bs0kph0yEdX94RJ0OXkDrgpTYhXFpiBxTNXwXOQcHeEMyCTWiUn0UifSCjH-BUzIQIRkTAhH29ger-roRdX7bj8uLES-5i9Z1C-SF5CIK3UUrn0WlY1FxBs1dNWVzPnxJN0nbgStpBy-wj6nbh16LmaOu-LKqOtJWxGdHJ7daRCWiINogXnlhGgSF8jQd2F9M3Rl5JGBkoHcW61zLYFLWQIVxq8phLTxxBUgDeJxOirhYfPyw7uHCkqLJ2kSsBacRzSntnEbEnYHktovC9-bpMaKM4WM6p2DtiGMIgbTpu2Wo4BE8bE4UFYabAB7dIzStDb0tLvT6vUNxOLaY13019eMUWYJIETYUD7CisZBBO1iDvHHa4TVmfSX8YhldgOwjW2opR0RyvSZZDH_dIYePdwilYpj4dvg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6830380772995&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: 4e3cb75ac65c98d3bc2c3b52e3c7227441458f5edbc815b0257128c657675bdb

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2078
Content-Type: text/html; charset=utf-8
Date: Mon, 27 Nov 2023 06:00:48 GMT
Expires: Mon, 27 Nov 2023 06:00:48 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H2 200 impression.php
t23.intelliad.de/ Frame D472 43 B
555 B 66ms
21ms Image
image/gif 52.29.112.162
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t23.intelliad.de/impression.php?cl=2353636373136323131303&cp=101&ag=248&bm=100&bmcl=5373735313236323131303&crid=101&timestamp=1701064848&co=
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.112.162 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-112-162.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: Apache
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW NID PSAo PSDo OUR STP OTC"
content-type: image/gif
cache-control: no-store, no-cache, max-age=0, must-revalidate
content-length: 43
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

htlp Show response
futalis.de/ Frame 1CA3
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=18540500016874104444994012521015&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252222

350 B
400 B

9ms
8ms

Document
text/html

49.12.16.151
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252222
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c0e6865111&subid=&uid=022afca568fd034e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoktJjzBkZfa7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0Cj_4MfMx5hc1jcRRv7J1CImTokLVlsA2HXYHRDNdv8kp3uRUCW49nIG1hfjFbFblgMNJcbsEg5tXGoOxTapq2IAyJC8Bt3haNLT9YtHXHRvyYbxngnypTT7E7p1sr1GHwpv5_XNAWga7O2olgE4_jqZdhWDhuWW6qFTiK2cFnuJXtnlVTCPBhP1kO77Nv7XXrXzfqe581x6obVa_AHMkA8nqX3X0ap2emUaJlY43ZNMX67NgUCXEMhkFiCfr25yCI5BC6gYrziH1sa72EXWsK3AW54_Rad4g1r2ytRjTtM1WGbblzeHVSEABeXC1DTDZCPD1W1VAj-JsCU8ooGdAlGcPwm81r7agsKun94vh_QTTNzt80D9aHWVwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIg4v1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_0hDwJNY33lqT9ob2Nc13CMBgKtpg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DNKfAv-jd615doY0watjNXP3SID06eE_azra4kZ45JtJsBn_5tMVg3Fi71svarXgMo2nFNBX8MIipevXinU_CCY9wLtkCQ7X-QagH-y04bxw9EOKqBXjsPnmv7tej1N4X44dmVuftsVigZxXhsDJzxBj7vL7QHY1__2scoPQKafaokMFs%26cry%3D1%26dbm_d%3DAKAmf-CY0aE1bFYPwD0tXJxXpaaDgfuXcHWLCR531vIFkxli1aQuLyOndETBtY367bHEpzmiWzWPwhNfSL3TAcWidMZ3VQSHwpYe9CGWyWY2yY2k97tPtBqbV10NotblxFJag6vwsmZJ_YGMGN6fKBq91STpSCfZUurUMj8qw3GQfcfEckD_2VLQmlLqVwCz-D1cXa-79NXO-B82PTeR4nIXmsK16EksjqsePS5kf-wQHTGfg2pwZU8JyDSnNuB70cOMdl8Uo6ppB-SKK2ROSDNLqrC6p4hTGS97J71dcEK4kuvAMIRQdhpgpd2Bqt81cBnc_DhYXFuR9ui_ck0z8yrO6E4QsdG4dNPOstWieVn06wtpNsIOH33gOMywoI7p6PJ4ewmhJo8kLEVB2nhbGEdAhrA5AGjmxhDaA1TK-JGG-jdQNYcmdgm2244_poOP7mAnsb1jrrzPtWQMseTpsHSFxQn0gBuf58YbLf3apM894M9O0ogZ4NpcHg5u8nbP-7PKjmEK9n6b17qYAgQIQoqIl99mOXHI08bgbWe01ctVOPrFjiMchGyWexIu2kQ3VFEF4BwwA7EKd4OgiJFnyfvL6elN5jtS2w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=2899310444873&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 49.12.16.151 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-1.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Mon, 27 Nov 2023 06:00:48 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252222
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame A07A
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=18540500016874104444994012521015&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=18540500016874104444994012521015&actionid=879111&produktid=ratenkredit&dt_url=

0
201 B

31ms
30ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=18540500016874104444994012521015&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c0e6865111&subid=&uid=022afca568fd034e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoktJjzBkZfa7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0Cj_4MfMx5hc1jcRRv7J1CImTokLVlsA2HXYHRDNdv8kp3uRUCW49nIG1hfjFbFblgMNJcbsEg5tXGoOxTapq2IAyJC8Bt3haNLT9YtHXHRvyYbxngnypTT7E7p1sr1GHwpv5_XNAWga7O2olgE4_jqZdhWDhuWW6qFTiK2cFnuJXtnlVTCPBhP1kO77Nv7XXrXzfqe581x6obVa_AHMkA8nqX3X0ap2emUaJlY43ZNMX67NgUCXEMhkFiCfr25yCI5BC6gYrziH1sa72EXWsK3AW54_Rad4g1r2ytRjTtM1WGbblzeHVSEABeXC1DTDZCPD1W1VAj-JsCU8ooGdAlGcPwm81r7agsKun94vh_QTTNzt80D9aHWVwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIg4v1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_0hDwJNY33lqT9ob2Nc13CMBgKtpg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DNKfAv-jd615doY0watjNXP3SID06eE_azra4kZ45JtJsBn_5tMVg3Fi71svarXgMo2nFNBX8MIipevXinU_CCY9wLtkCQ7X-QagH-y04bxw9EOKqBXjsPnmv7tej1N4X44dmVuftsVigZxXhsDJzxBj7vL7QHY1__2scoPQKafaokMFs%26cry%3D1%26dbm_d%3DAKAmf-CY0aE1bFYPwD0tXJxXpaaDgfuXcHWLCR531vIFkxli1aQuLyOndETBtY367bHEpzmiWzWPwhNfSL3TAcWidMZ3VQSHwpYe9CGWyWY2yY2k97tPtBqbV10NotblxFJag6vwsmZJ_YGMGN6fKBq91STpSCfZUurUMj8qw3GQfcfEckD_2VLQmlLqVwCz-D1cXa-79NXO-B82PTeR4nIXmsK16EksjqsePS5kf-wQHTGfg2pwZU8JyDSnNuB70cOMdl8Uo6ppB-SKK2ROSDNLqrC6p4hTGS97J71dcEK4kuvAMIRQdhpgpd2Bqt81cBnc_DhYXFuR9ui_ck0z8yrO6E4QsdG4dNPOstWieVn06wtpNsIOH33gOMywoI7p6PJ4ewmhJo8kLEVB2nhbGEdAhrA5AGjmxhDaA1TK-JGG-jdQNYcmdgm2244_poOP7mAnsb1jrrzPtWQMseTpsHSFxQn0gBuf58YbLf3apM894M9O0ogZ4NpcHg5u8nbP-7PKjmEK9n6b17qYAgQIQoqIl99mOXHI08bgbWe01ctVOPrFjiMchGyWexIu2kQ3VFEF4BwwA7EKd4OgiJFnyfvL6elN5jtS2w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=2899310444873&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 27 Nov 2023 06:00:47 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Mon, 27 Nov 2023 07:00:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Mon, 27 Nov 2023 06:00:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=18540500016874104444994012521015&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: 515F0528:A058_91EFC182:01BB_65643090_805C2F6:1E879

GET
H2 200 / Show response
adv.office-partner.de/ Frame 80D4 930 B
922 B 7ms
7ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c0e6865111&subid=&uid=022afca568fd034e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoktJjzBkZfa7LvvH7_UPkIWC2A2m5b2gab2TnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmwJP0Cj_4MfMx5hc1jcRRv7J1CImTokLVlsA2HXYHRDNdv8kp3uRUCW49nIG1hfjFbFblgMNJcbsEg5tXGoOxTapq2IAyJC8Bt3haNLT9YtHXHRvyYbxngnypTT7E7p1sr1GHwpv5_XNAWga7O2olgE4_jqZdhWDhuWW6qFTiK2cFnuJXtnlVTCPBhP1kO77Nv7XXrXzfqe581x6obVa_AHMkA8nqX3X0ap2emUaJlY43ZNMX67NgUCXEMhkFiCfr25yCI5BC6gYrziH1sa72EXWsK3AW54_Rad4g1r2ytRjTtM1WGbblzeHVSEABeXC1DTDZCPD1W1VAj-JsCU8ooGdAlGcPwm81r7agsKun94vh_QTTNzt80D9aHWVwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbECqg0CREXiDRMIg4v1r8DjggMV--O7CB2QggDbsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_0hDwJNY33lqT9ob2Nc13CMBgKtpg%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-DNKfAv-jd615doY0watjNXP3SID06eE_azra4kZ45JtJsBn_5tMVg3Fi71svarXgMo2nFNBX8MIipevXinU_CCY9wLtkCQ7X-QagH-y04bxw9EOKqBXjsPnmv7tej1N4X44dmVuftsVigZxXhsDJzxBj7vL7QHY1__2scoPQKafaokMFs%26cry%3D1%26dbm_d%3DAKAmf-CY0aE1bFYPwD0tXJxXpaaDgfuXcHWLCR531vIFkxli1aQuLyOndETBtY367bHEpzmiWzWPwhNfSL3TAcWidMZ3VQSHwpYe9CGWyWY2yY2k97tPtBqbV10NotblxFJag6vwsmZJ_YGMGN6fKBq91STpSCfZUurUMj8qw3GQfcfEckD_2VLQmlLqVwCz-D1cXa-79NXO-B82PTeR4nIXmsK16EksjqsePS5kf-wQHTGfg2pwZU8JyDSnNuB70cOMdl8Uo6ppB-SKK2ROSDNLqrC6p4hTGS97J71dcEK4kuvAMIRQdhpgpd2Bqt81cBnc_DhYXFuR9ui_ck0z8yrO6E4QsdG4dNPOstWieVn06wtpNsIOH33gOMywoI7p6PJ4ewmhJo8kLEVB2nhbGEdAhrA5AGjmxhDaA1TK-JGG-jdQNYcmdgm2244_poOP7mAnsb1jrrzPtWQMseTpsHSFxQn0gBuf58YbLf3apM894M9O0ogZ4NpcHg5u8nbP-7PKjmEK9n6b17qYAgQIQoqIl99mOXHI08bgbWe01ctVOPrFjiMchGyWexIu2kQ3VFEF4BwwA7EKd4OgiJFnyfvL6elN5jtS2w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=2899310444873&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Mon, 27 Nov 2023 06:00:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Mon, 04 Dec 2023 06:00:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame D9F3
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=18540500016874104444994012521015&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=18540500016874104444994012521015&actionid=879111&produktid=ratenkredit&dt_url=

0
36 B

86ms
86ms

Script
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=18540500016874104444994012521015&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:47 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Mon, 27 Nov 2023 07:00:48 GMT
server: Microsoft-IIS/10.0
access-control-allow-methods: GET,POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Mon, 27 Nov 2023 06:00:48 GMT
strict-transport-security: max-age=15768000
x-iplb-instance: 40027
content-length: 0
proxy-host: pv.medialead.de
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: 515F0528:A06A_91EFC182:01BB_65643090_805A35A:1E87B
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=18540500016874104444994012521015&actionid=879111&produktid=ratenkredit&dt_url=
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame D9F3 43 B
666 B 102ms
72ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=18540500016874104444994012521015&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: 515F0528:A074_91EFC182:01BB_65643090_8058A7F:1E878
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

GET
H2

200

htlp Show response
futalis.de/ Frame DE50
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=88729800017758304445002012521017&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252223

350 B
400 B

13ms
12ms

Document
text/html

49.12.16.151
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252223
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=9aca3c0780&subid=&uid=c8607bc1aecd2229&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrLQ8jzBkZfi7LvvH7_UPkIWC2A2m5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0EmFhMOV1H1OvQba12zBQnkDoWbhrBliEKkgBIhBNBSQxTh2KSD75155RL-tHpSopPLMmlwuqhI57grAu4DYH_35DhLtG-ah4oInJUJnL-R7nT6_d3X2ifQUj_xhNyphbRHbaMnjj0bfrzH8zDy8k-zJ4wAXhaUPUK-Y9AUS6U_zwEUlhyBSVv5VrwySgW30lbHGZ_aJLvid_ccjAJWF8mOvLupcOMZ1GNNgzf4N0ilj1adB__sZmV1BOnYDi1d33j31flER6P9TG9LMhInBL07SrCKIvwewO1QuD2svkb8oJ4aRDeg9jffpAvT-uXLgH3WaSCFKdgSN8Jy1WzrFMAyU1wwcERIYmgUKsG4jTFsBzulIaxOnynbABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiFi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_1eroY1zKr534v6kATicRALl8h8OQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CdT69-Q9L8T0MfIelRane0OPzhzMM8e-RUofkou6l8Vjo9wBLIkzHdlkcsqTk8C-G6Il3BufY3chnyQFbWmWvqgck8l7EI61McMKmchL68OH1eM-Lr1OLQsv0vtJXVBmMFHydk2d1ye6SCgaZp-_8gi1q-9gaMgZJ1iOZL4_ps-tkGPMA%26cry%3D1%26dbm_d%3DAKAmf-CoIsMIdueEDMY_KREry_w2cxiDtXHP1e41yZcNo9DembfPt3gHbpsjqwxyHr-Fa5JG5Diq-gbWQQuHYgNUKsToPegEc7JBy1KAT18g-pXANFjUqJYUjyOdmHSCWe9X8HDTj24l2xZdGvwXVJsweiAzicCbuo_Bq7NvQfOmktWkPGzs1VMO259Vk9iCcaQKtsb99x3sgiH2ocopGdxP_zP0fTvoptj-mjc5iMIgiw8xEQeF3ENv0RGDbcCC7-S0cFMFftaTnrSyMxP7w9F2lCGPo1MxZ9JylPsL0wtk2Sk05T7x_8bdvijwhxw968WEf6WwHuX8uL88S8AeSacgVj1s9u-8xULCj1YJ7QnORuXkiM2NImB-asf3FSF__7qyGqrZ15fCvTRCV32N_N_JE5Qhx6CmGdDPCG-B_WFjEcktTv_DFMGppVNl0CyNFn9shliTPwZvPU_29J7AwBB1NC6hCiKXccDPVOcGx4z8224x-Nd23n82YMN9p2Wjvq7k8Scb6Iv4BEwbe3V9iqYK2KtKi-OrrV2e6Pq7o5QP2vgS-layMGcP5tMydm4nT5qjb95sGbvtLY_YemoopuI4PlmvoDGQ8w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8747164467189&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 49.12.16.151 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-1.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Mon, 27 Nov 2023 06:00:48 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252223
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 0154
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=88729800017758304445002012521017&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=88729800017758304445002012521017&actionid=879111&produktid=ratenkredit&dt_url=

0
202 B

28ms
26ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=88729800017758304445002012521017&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=9aca3c0780&subid=&uid=c8607bc1aecd2229&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrLQ8jzBkZfi7LvvH7_UPkIWC2A2m5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0EmFhMOV1H1OvQba12zBQnkDoWbhrBliEKkgBIhBNBSQxTh2KSD75155RL-tHpSopPLMmlwuqhI57grAu4DYH_35DhLtG-ah4oInJUJnL-R7nT6_d3X2ifQUj_xhNyphbRHbaMnjj0bfrzH8zDy8k-zJ4wAXhaUPUK-Y9AUS6U_zwEUlhyBSVv5VrwySgW30lbHGZ_aJLvid_ccjAJWF8mOvLupcOMZ1GNNgzf4N0ilj1adB__sZmV1BOnYDi1d33j31flER6P9TG9LMhInBL07SrCKIvwewO1QuD2svkb8oJ4aRDeg9jffpAvT-uXLgH3WaSCFKdgSN8Jy1WzrFMAyU1wwcERIYmgUKsG4jTFsBzulIaxOnynbABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiFi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_1eroY1zKr534v6kATicRALl8h8OQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CdT69-Q9L8T0MfIelRane0OPzhzMM8e-RUofkou6l8Vjo9wBLIkzHdlkcsqTk8C-G6Il3BufY3chnyQFbWmWvqgck8l7EI61McMKmchL68OH1eM-Lr1OLQsv0vtJXVBmMFHydk2d1ye6SCgaZp-_8gi1q-9gaMgZJ1iOZL4_ps-tkGPMA%26cry%3D1%26dbm_d%3DAKAmf-CoIsMIdueEDMY_KREry_w2cxiDtXHP1e41yZcNo9DembfPt3gHbpsjqwxyHr-Fa5JG5Diq-gbWQQuHYgNUKsToPegEc7JBy1KAT18g-pXANFjUqJYUjyOdmHSCWe9X8HDTj24l2xZdGvwXVJsweiAzicCbuo_Bq7NvQfOmktWkPGzs1VMO259Vk9iCcaQKtsb99x3sgiH2ocopGdxP_zP0fTvoptj-mjc5iMIgiw8xEQeF3ENv0RGDbcCC7-S0cFMFftaTnrSyMxP7w9F2lCGPo1MxZ9JylPsL0wtk2Sk05T7x_8bdvijwhxw968WEf6WwHuX8uL88S8AeSacgVj1s9u-8xULCj1YJ7QnORuXkiM2NImB-asf3FSF__7qyGqrZ15fCvTRCV32N_N_JE5Qhx6CmGdDPCG-B_WFjEcktTv_DFMGppVNl0CyNFn9shliTPwZvPU_29J7AwBB1NC6hCiKXccDPVOcGx4z8224x-Nd23n82YMN9p2Wjvq7k8Scb6Iv4BEwbe3V9iqYK2KtKi-OrrV2e6Pq7o5QP2vgS-layMGcP5tMydm4nT5qjb95sGbvtLY_YemoopuI4PlmvoDGQ8w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8747164467189&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 27 Nov 2023 06:00:47 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Mon, 27 Nov 2023 07:00:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Mon, 27 Nov 2023 06:00:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=88729800017758304445002012521017&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: 515F0528:A05A_91EFC182:01BB_65643090_8058A7D:1E878

GET
H2 200 / Show response
adv.office-partner.de/ Frame EA79 930 B
922 B 6ms
6ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=9aca3c0780&subid=&uid=c8607bc1aecd2229&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrLQ8jzBkZfi7LvvH7_UPkIWC2A2m5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0EmFhMOV1H1OvQba12zBQnkDoWbhrBliEKkgBIhBNBSQxTh2KSD75155RL-tHpSopPLMmlwuqhI57grAu4DYH_35DhLtG-ah4oInJUJnL-R7nT6_d3X2ifQUj_xhNyphbRHbaMnjj0bfrzH8zDy8k-zJ4wAXhaUPUK-Y9AUS6U_zwEUlhyBSVv5VrwySgW30lbHGZ_aJLvid_ccjAJWF8mOvLupcOMZ1GNNgzf4N0ilj1adB__sZmV1BOnYDi1d33j31flER6P9TG9LMhInBL07SrCKIvwewO1QuD2svkb8oJ4aRDeg9jffpAvT-uXLgH3WaSCFKdgSN8Jy1WzrFMAyU1wwcERIYmgUKsG4jTFsBzulIaxOnynbABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiFi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_1eroY1zKr534v6kATicRALl8h8OQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CdT69-Q9L8T0MfIelRane0OPzhzMM8e-RUofkou6l8Vjo9wBLIkzHdlkcsqTk8C-G6Il3BufY3chnyQFbWmWvqgck8l7EI61McMKmchL68OH1eM-Lr1OLQsv0vtJXVBmMFHydk2d1ye6SCgaZp-_8gi1q-9gaMgZJ1iOZL4_ps-tkGPMA%26cry%3D1%26dbm_d%3DAKAmf-CoIsMIdueEDMY_KREry_w2cxiDtXHP1e41yZcNo9DembfPt3gHbpsjqwxyHr-Fa5JG5Diq-gbWQQuHYgNUKsToPegEc7JBy1KAT18g-pXANFjUqJYUjyOdmHSCWe9X8HDTj24l2xZdGvwXVJsweiAzicCbuo_Bq7NvQfOmktWkPGzs1VMO259Vk9iCcaQKtsb99x3sgiH2ocopGdxP_zP0fTvoptj-mjc5iMIgiw8xEQeF3ENv0RGDbcCC7-S0cFMFftaTnrSyMxP7w9F2lCGPo1MxZ9JylPsL0wtk2Sk05T7x_8bdvijwhxw968WEf6WwHuX8uL88S8AeSacgVj1s9u-8xULCj1YJ7QnORuXkiM2NImB-asf3FSF__7qyGqrZ15fCvTRCV32N_N_JE5Qhx6CmGdDPCG-B_WFjEcktTv_DFMGppVNl0CyNFn9shliTPwZvPU_29J7AwBB1NC6hCiKXccDPVOcGx4z8224x-Nd23n82YMN9p2Wjvq7k8Scb6Iv4BEwbe3V9iqYK2KtKi-OrrV2e6Pq7o5QP2vgS-layMGcP5tMydm4nT5qjb95sGbvtLY_YemoopuI4PlmvoDGQ8w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8747164467189&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Mon, 27 Nov 2023 06:00:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Mon, 04 Dec 2023 06:00:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 51CF 2 KB
2 KB 73ms
73ms Script
text/html 3.11.123.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=88729800017758304445002012521017&nw=1
Requested by: Host: vodafoneidea.ph
URL: http://vodafoneidea.ph/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.123.127 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-123-127.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 983069fa701bdf3e6ef8d89c5259939d8589b72df6c6f0d923072eac3acfad12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
last-modified: Mon, 27 Nov 2023 06:00:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Mon, 27 Nov 2023 06:01:48 GMT

GET
H3

200

activityi;dc_pre=CNmxsrDA44IDFUhGkQUdUzMHnQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2864981555819.912 Show response
5994599.fls.doubleclick.net/ Frame 549D
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2864981555819.912?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CNmxsrDA44IDFUhGkQUdUzMHnQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2864981555819.912?

391 B
238 B

53ms
53ms

Document
text/html

142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CNmxsrDA44IDFUhGkQUdUzMHnQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2864981555819.912?

Requested by

Host: vodafoneidea.ph
URL: http://vodafoneidea.ph/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d3d3f099069ec17838268cfe51588f5837f7da4dbd4010abddd4e8b1bf4e9fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
expires: Mon, 27 Nov 2023 06:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNmxsrDA44IDFUhGkQUdUzMHnQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2864981555819.912?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900017.redintelligence.net/ Frame 1171 7 KB
2 KB 25ms
8ms Document
text/html 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/request_content.php?s=88729800017758304445002012521017&a=6a3d8545
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=9aca3c0780&subid=&uid=c8607bc1aecd2229&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrLQ8jzBkZfi7LvvH7_UPkIWC2A2m5b2gaZ2XnKfJD_AuEAEghveGJmCVgoCAmAfIAQmpAgfENCuTWrI-qAMByAObBKoEmgJP0EmFhMOV1H1OvQba12zBQnkDoWbhrBliEKkgBIhBNBSQxTh2KSD75155RL-tHpSopPLMmlwuqhI57grAu4DYH_35DhLtG-ah4oInJUJnL-R7nT6_d3X2ifQUj_xhNyphbRHbaMnjj0bfrzH8zDy8k-zJ4wAXhaUPUK-Y9AUS6U_zwEUlhyBSVv5VrwySgW30lbHGZ_aJLvid_ccjAJWF8mOvLupcOMZ1GNNgzf4N0ilj1adB__sZmV1BOnYDi1d33j31flER6P9TG9LMhInBL07SrCKIvwewO1QuD2svkb8oJ4aRDeg9jffpAvT-uXLgH3WaSCFKdgSN8Jy1WzrFMAyU1wwcERIYmgUKsG4jTFsBzulIaxOnynbABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqACgOYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJEReINEwiFi_WvwOOCAxX747sIHZCCANuwE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB%26sig%3DAOD64_1eroY1zKr534v6kATicRALl8h8OQ%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CdT69-Q9L8T0MfIelRane0OPzhzMM8e-RUofkou6l8Vjo9wBLIkzHdlkcsqTk8C-G6Il3BufY3chnyQFbWmWvqgck8l7EI61McMKmchL68OH1eM-Lr1OLQsv0vtJXVBmMFHydk2d1ye6SCgaZp-_8gi1q-9gaMgZJ1iOZL4_ps-tkGPMA%26cry%3D1%26dbm_d%3DAKAmf-CoIsMIdueEDMY_KREry_w2cxiDtXHP1e41yZcNo9DembfPt3gHbpsjqwxyHr-Fa5JG5Diq-gbWQQuHYgNUKsToPegEc7JBy1KAT18g-pXANFjUqJYUjyOdmHSCWe9X8HDTj24l2xZdGvwXVJsweiAzicCbuo_Bq7NvQfOmktWkPGzs1VMO259Vk9iCcaQKtsb99x3sgiH2ocopGdxP_zP0fTvoptj-mjc5iMIgiw8xEQeF3ENv0RGDbcCC7-S0cFMFftaTnrSyMxP7w9F2lCGPo1MxZ9JylPsL0wtk2Sk05T7x_8bdvijwhxw968WEf6WwHuX8uL88S8AeSacgVj1s9u-8xULCj1YJ7QnORuXkiM2NImB-asf3FSF__7qyGqrZ15fCvTRCV32N_N_JE5Qhx6CmGdDPCG-B_WFjEcktTv_DFMGppVNl0CyNFn9shliTPwZvPU_29J7AwBB1NC6hCiKXccDPVOcGx4z8224x-Nd23n82YMN9p2Wjvq7k8Scb6Iv4BEwbe3V9iqYK2KtKi-OrrV2e6Pq7o5QP2vgS-layMGcP5tMydm4nT5qjb95sGbvtLY_YemoopuI4PlmvoDGQ8w%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8747164467189&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: c8b0b6d29f62a63785d6b09d41ed954dc8179b5046c6c7efe932534a548d7206

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2093
Content-Type: text/html; charset=utf-8
Date: Mon, 27 Nov 2023 06:00:48 GMT
Expires: Mon, 27 Nov 2023 06:00:48 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 51CF
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=88729800017758304445002012521017&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=88729800017758304445002012521017&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
666 B

46ms
35ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=88729800017758304445002012521017&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: 515F0528:A04E_91EFC182:01BB_65643090_8058ED1:1E87A
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=88729800017758304445002012521017&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Mon, 27 Nov 2023 06:00:48 GMT
server: nginx
content-length: 138
content-type: text/html

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 7FFA 174 KB
62 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

99dd06fdc2bdaa346a6b34f4bd3356df707daa98f5c5d96bfad9e04a5cec24cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63927
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame 858B 5 KB
5 KB 4ms
4ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252217
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
last-modified: Wed, 05 Apr 2023 20:14:46 GMT
server: Apache
etag: "1416-5f89c717cdc2f"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5142

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 899E 1 KB
643 B 7ms
6ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 74133
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 09:25:15 GMT
etag: 48472445140208031
expires: Mon, 27 Nov 2023 09:25:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D472 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d12a83f921c16b94493182de4355e75969d771387dc51babe72e293a14eca87

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4EDC 1 KB
643 B 6ms
6ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 74133
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 09:25:15 GMT
etag: 48472445140208031
expires: Mon, 27 Nov 2023 09:25:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 51CF 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b25973253a8395f30e9e85e55fd4df059ed36f74a288e8d4c6143a72360092d2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 66D3
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEJEscIFGAGkr4RpC2MKBQN4&google_cver=1&google_push=AXcoOmQivoPHn9JrsRo7oXHFoyjOOIZNc7F4uZY_LMInGZvTw0kJulm9eL0ydknufbxakPXDGne9tqsO_yicxfFZiLGA5lCE8COF
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=511CC608EEE84B70A0464EAB464484A0&google_push=AXcoOmQivoPHn9JrsRo7oXHFoyjOOIZNc7F4uZY_LMInGZvTw0kJulm9eL0ydknufbxakPXDGne9tqsO_yicxfF...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=511CC608EEE84B70A0464EAB464484A0&google_push=AXcoOmQivoPHn9JrsRo7oXHFoyjOOIZNc7F4uZY_LMInGZvTw0kJulm9eL0ydknufbxakPXDGne9tqsO_yicxfFZiLGA5lCE8COF

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Nov 2023 06:00:48 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=511CC608EEE84B70A0464EAB464484A0&google_push=AXcoOmQivoPHn9JrsRo7oXHFoyjOOIZNc7F4uZY_LMInGZvTw0kJulm9eL0ydknufbxakPXDGne9tqsO_yicxfFZiLGA5lCE8COF
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 26 Nov 2023 06:00:48 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 66D3 0
172 B 50ms
15ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEMgUxg_cpos7g_iNhPcWf38&google_cver=1&google_push=AXcoOmQkZKoaS-dk96KeVFSr79U_byBGNUft0EyK8uSRnD3_Mogu8Jyxsi175k8aw06cIlyBDPvw2yYlOjtJ_eCACEJI9Ki95T_Z
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 66D3
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECrrXA5qK-fMnYRbchtvjHQ&google_cver=1&google_push=AXcoOmRuPXVG9rfpBQvVUfe01gX4Dg-3_WrI-GHZqzm61Zc0TUwhuj6S-F5EcUNq_omz6tCJizFvOt5pMqzXhsSzh5Z2zdZ...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRuPXVG9rfpBQvVUfe01gX4Dg-3_WrI-GHZqzm61Zc0TUwhuj6S-F5EcUNq_omz6tCJizFvOt5pMqzXhsSzh5Z2zdZhdnxA&google_hm=eS1YMm9tZ0V4RTJwRl9Bcj...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRuPXVG9rfpBQvVUfe01gX4Dg-3_WrI-GHZqzm61Zc0TUwhuj6S-F5EcUNq_omz6tCJizFvOt5pMqzXhsSzh5Z2zdZhdnxA&google_hm=eS1YMm9tZ0V4RTJwRl9BcjdYNTRsbG1lTVVqTXBlN1lhOX5B

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Nov 2023 06:00:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRuPXVG9rfpBQvVUfe01gX4Dg-3_WrI-GHZqzm61Zc0TUwhuj6S-F5EcUNq_omz6tCJizFvOt5pMqzXhsSzh5Z2zdZhdnxA&google_hm=eS1YMm9tZ0V4RTJwRl9BcjdYNTRsbG1lTVVqTXBlN1lhOX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 66D3
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSb0x...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSb0xlxlhFm6JIqd4CLmb0R9D2D2RJXkwuo99R6vagkq6BsNh8S2hxr5vFCeI9AXAUr2QaatM_GfTPN...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSb0xlxlhFm6JIqd4CLmb0R9D2D2RJXkwuo99R6vagkq6BsNh8S2hxr5vFCeI9AXAUr2QaatM_GfTPNqV1LXitC1d6zzWyJ

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSb0xlxlhFm6JIqd4CLmb0R9D2D2RJXkwuo99R6vagkq6BsNh8S2hxr5vFCeI9AXAUr2QaatM_GfTPNqV1LXitC1d6zzWyJ
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 801983
content-length: 0
expires: Mon, 27 Nov 2023 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 66D3 43 B
236 B 50ms
15ms Image
image/gif 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESELThMTheH4DK4FvvuhUilfs&google_cver=1&google_push=AXcoOmQpwGQwkhWfaO0lNgBGNmYl92IZhNTYzCJKEejta8syDJwRrs2PHRu--CWdRKX7Yqsw0xoLcYgZ80VkS6aX5oFL9v2xYB9G
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 66D3
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEHIeU719eFLZdU8tyAbQUpI&google_cver=1&google_push=AXcoOmRZyvHDDtbJ2iNWqNWpSPKmnVGXuAaqkcdyKQIRnuPaBbVG0lE8QTPWvx2kFTg0FoNwwzu7ODDlwgnXa-z...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=OSdrsg9TVENLHBBdZCgdJlFfBSg&google_push=AXcoOmRZyvHDDtbJ2iNWqNWpSPKmnVGXuAaqkcdyKQIRnuPaBbVG0lE8QTPWvx2kFTg0FoNwwzu7ODDlwgnXa-...

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=OSdrsg9TVENLHBBdZCgdJlFfBSg&google_push=AXcoOmRZyvHDDtbJ2iNWqNWpSPKmnVGXuAaqkcdyKQIRnuPaBbVG0lE8QTPWvx2kFTg0FoNwwzu7ODDlwgnXa-zzPp_3I2Unty9_

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=OSdrsg9TVENLHBBdZCgdJlFfBSg&google_push=AXcoOmRZyvHDDtbJ2iNWqNWpSPKmnVGXuAaqkcdyKQIRnuPaBbVG0lE8QTPWvx2kFTg0FoNwwzu7ODDlwgnXa-zzPp_3I2Unty9_
Date: Mon, 27 Nov 2023 06:00:49 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 66D3
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmQs3v990HgoMuqcMgt7z7Wvu59YV7VNS...

170 B
188 B

19ms
19ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmQs3v990HgoMuqcMgt7z7Wvu59YV7VNSTn5GdakvE6OmIMopLBRP1IgguldcjGZGc1BIdippUWFPf4vgiWKGqYBN1F_mNer

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r0gQum6DhY75FFHELpqJyT4aQZbjv5j6f62I12PykAufMR0ckA%2BHMi0fcxJlcTkRVLo3T2BiJguEWyUjg6SldXLUVfz%2BwilCc%2FEtFQL%2BtYeMhQ%2Bamgrs4VwLD0LaIZs11Ii%2BWIMVkX55jg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmQs3v990HgoMuqcMgt7z7Wvu59YV7VNSTn5GdakvE6OmIMopLBRP1IgguldcjGZGc1BIdippUWFPf4vgiWKGqYBN1F_mNer
cache-control: no-cache
cf-ray: 82c82728ea1937ca-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 66D3 0
12 B 17ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L_wmOmFzDB5VBC40zmb4iaIORQfAg4ux9kMrCLqpMcyqmsRS2QnfjcjmfB9PqyTltHqj4D

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame 1CA3 5 KB
5 KB 4ms
4ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252222
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
last-modified: Wed, 05 Apr 2023 20:14:46 GMT
server: Apache
etag: "1416-5f89c717cdc2f"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5142

GET
H3 200 css
fonts.googleapis.com/ Frame 4B52 2 KB
434 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=71561800017758104444550012521017&a=98b6eeef

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 05:12:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4B52 16 KB
16 KB 22ms
7ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=71561800017758104444550012521017&a=98b6eeef
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: d92a084f754386d657e935721ef3060c78b0bed045c1eb6ce52b870b82653383

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16512
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4B52 10 KB
10 KB 176ms
161ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71572/creativesup/iQ_Online-Deutschkurse_1200x627px.jpg
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=71561800017758104444550012521017&a=98b6eeef
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: f786be6e18dcf3f375e6bdb53508fc5d50464f6f93c1cb6d9044771d9d0191da

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10144
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4B52 13 KB
13 KB 22ms
8ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=71561800017758104444550012521017&a=98b6eeef
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: ce54602423b934e22b74d418617094c9a35690afc8bb08ef6255adb166e9e125

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12996
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame 4F2C 5 KB
5 KB 4ms
4ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252221
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
last-modified: Wed, 05 Apr 2023 20:14:46 GMT
server: Apache
etag: "1416-5f89c717cdc2f"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5142

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame DE50 5 KB
5 KB 6ms
5ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3345252223
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
last-modified: Wed, 05 Apr 2023 20:14:46 GMT
server: Apache
etag: "1416-5f89c717cdc2f"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5142

GET
H3 200 css
fonts.googleapis.com/ Frame 1171 5 KB
682 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=88729800017758304445002012521017&a=6a3d8545

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 04:22:12 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 1171 13 KB
13 KB 21ms
9ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=88729800017758304445002012521017&a=6a3d8545
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: ce54602423b934e22b74d418617094c9a35690afc8bb08ef6255adb166e9e125

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12996
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 1171 17 KB
17 KB 22ms
9ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=88729800017758304445002012521017&a=6a3d8545
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 9149d214e2f1e2a3ae0dc58697504d743bd677afbe7685f74ab5eb72359d97a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 1171 16 KB
16 KB 20ms
8ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=88729800017758304445002012521017&a=6a3d8545
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: d92a084f754386d657e935721ef3060c78b0bed045c1eb6ce52b870b82653383

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16512
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 59AE 174 KB
62 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b855ab19fb331f91e603b604bc83aee1e2fcab39bf3f497fd7c437a5c22f46aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63898
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H/1.1 200
OK viewability Show response
hal90006.redintelligence.net/ Frame 4597 0
150 B 24ms
7ms Script
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/viewability?s=78339700016663304444994012521006&a=104447f2&vb=m
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=78339700016663304444994012521006&a=6b04bd91
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/request_content.php?s=78339700016663304444994012521006&a=6b04bd91
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 80D4 174 KB
62 KB 17ms
17ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ec6b87bb1283e03eb16d0526de79ac08a8a3bd4051ce40579dafb4f6e8e503d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63902
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame EA79 174 KB
62 KB 22ms
21ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bf90b980d38304213f176f2a46f4b8a6229a08ab49f0f057fa2eed5859b8bfc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63901
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C8DC 0
20 B 44ms
42ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BWmPbkDBkZY77Gu689u8Pv_OLmA8AAAAAOAHgBAI&bg=!d3SldDvNAAZxrfrxUa07ADQBe5WfOJHZulq4xPgy1-XbEWMjmWgZxNbvAV30iwtSBjBlCssRCBMPFMFXwHBOCZRxylEpAgAAAJ1SAAAAAWgBB5kDBPGWpWN24jtjUZlpXRYomD4PxXw7aqVDeSzi4o_mhJs0wsqFG9adXYQvlGlfJLg3EdKAmtfkKl9yJMRz1S3RY7dBUEacq4U-BybAhW2GGD0JZ1gvYSjbPdiuCdfa1lyYoNzGGaCtdyuWuu-uwvXoJ--caNDkE_g5E8qljpIJ71BhVmqxghc5wZ6fnHkRcDx2SwskLELCUR7vwbL_qwutCG6pDM97tP37nak1PeMOJzHprbDH_6xGSsKbCnTaFFw2Rrmt8Ef4ruoPES4QuKoSnRMVdEZwqclkC7Y2P6N7NBJ5aoetLG7SABn6gMGIIyvbCMQShtVNaBTy0xdQ67Sjs-CUQK1-yncX81Rnmp3dUd_A8ZXzfsdsjv58lI-lhxolkMkX2GkBKphy3dTVBTN9mxdDTYBh9RZQR2JjON3Y_21XpSmOE819_2JugkYCG71IihplnsJea6Io36lMFrgCq-keGkzDCN2Pu2nN06NLulv-BBMXisOglOHXnKVUMkK909zNFbmcvXSGRoQN37J9sJgEDhnfzfraTx_Am6dzLsucG8i-wSffNRlR17kECQJqhLqiSq-TAePA-7dj2v7qL6HVbjdcsa99AzKbVN643m0cRnsBgRrkiH8TFQGsp4ZbAbAI-WN-8NZXRwnNfyCBxOJiGABQbscEncKp1SJtX8a9WIDo7URT-SdsaIsgmGoixmevLItlXqsqq-EhqAR-VbCG0_Y64RBFrDw4itNVk5z7QOEwye6T0_g6MsxCUqzGEe-R103kV7fi0x7Ww0M-o0BA4YlZ2DWRRwJoWTMUP2VRB8lxfs5SJC5fFZThoLsO_WQiCo540IUZ9qXI3oFwmw7EGAuYgpaNbyheAEb7KyzD1wDmiHY757OSPPB1242-WCfNdtGt2yjOkNtr2y52u92T_0XltIh9zX5c6jWFTtKNcxHD8XU8N9K1QuqsIzz3ec3MlU6kzFaQWZHELZ49PcZNHmsuoQRVyZUwcKHH8iVHH1DUGufUVSACeIpr8RW2zI2i-Ew

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CKzfr7DA44IDFbFKkQUdBLAHeg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4494157273102.517
adservice.google.com/ddm/fls/z/ Frame CAF9 42 B
401 B 67ms
44ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKzfr7DA44IDFbFKkQUdBLAHeg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4494157273102.517

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CKzfr7DA44IDFbFKkQUdBLAHeg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4494157273102.517?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8186 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BmCCBkDBkZbTKG9u_9u8P3oiPuAIAAAAAOAHgBAI&bg=!c3ClcD_NAAZxrfrxUa07ADQBe5WfOC4N_gptdiw0NPAUO8_U-X3Ue8RViuQWNLwpgzUZhyfGZFE4iiEIESetqW4MS_mYAgAAAJ9SAAAAAWgBBwoAZvnG9-9viIbgFhFaxu87Ctubsf4a3aJ6T1pg1PJIkrmVQ45vC21k5D7WgtUqZ0mw8XBd6X3GSA2Qif7rdLtz8ZnxPSGPEqOcaZpLQwxjSk6nAEVx01Cbnt0WcdA0Tm-Apha1uE-bwJkDCAt7QH7yZVD3CM9bZgsa1uJY4QwGszeLmPDC_fh9EJ-KoicsLQ41F5IgSB3nrxEgzSOr9gLALv_Gg4pZw9Jybluje98PmEb5vclJDUHHHPuYL03BfQWcigUr9wiFQsIrE_1Wr--T8HFefVGK1XxaAPnH96HoHDrXP-Ctw_7xD2WnkOGOnGWCfNg8Bi4FO3rrSLN8HDGRxanYrNFsFMwjrcQ1h-URD47RDgicpgkBex2Dgn7JnLok7O9Wuz_ga9f-8oQQEJdsucttUoORRczGL535IuTNm5_YOF5sFIi6DDqXdYOkje75kVi9o64ci59I1XdUVwX9_QiZkdvB7ohlfdTitRlnXNfgNMlQLH0W5NXlrl2LLF1ZymZYy8EVFtTy0xjvITQ1kSdKi4Ct3SwxdVf3Y9kmxEtf-Fll0yYTzkZVZjJEtJHhem3OwUZbYQ0y8rac8DAH1GGBej8D7H3ZLorpn7Nd-r-GmOoRz3at47VNL0AKHQbdd9HieJ5lXBWLXLXLTcfesVjdE7bIdwwSF43wk83uwvxOohBFvBkZ9S0sqlgeGSRjVvJtdigWjtLx35ZQIPmJ78KbymUjA-0IREzt01nXyMQ4E8eeFFznUR1byNUxWLmoflzeE-wql10O07R1x7CwaiTaBlLfmw6klBzUvP3HFglpyfAdyl4POhJz4pY_b5SoRcCOmeEHucF87NrQulNhZkuvwi716ZIAcE016nR2to6ge_a2WqdS9DgFoFt5uELpft0hcyy5Osb_4iYkhBLb0wStA1gDGUjG1uv5yTHg5CkTjQTDy8RQotn9QI1l4gNfU-KJ8JK9aBLIbmMMrKlDe6t-JS8XrLamG6qyFo5uRa8helEwNUDN80wEzP8dNDOJ10sDx5huC-mtHn_YXluhlCPtj21s5wFkbnlpedJ9M1z00pP0Fc0fHQWNwl71dIw6f5ltV180be1jBa-XxNbHLy58iebfDhvyO6Z0-KACvOqhriR-PEe1eG9v9WuIsncsx9MnGgMSyMqvZ1asESGDIw3n

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 2F6C 15 KB
6 KB 15ms
15ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=simcast.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:47 GMT
server: Kestrel
server-processing-duration-in-ticks: 689545
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 94 KB
30 KB 50ms
24ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

17882276150f09461415088bd161e0242ce0327673dc9233e11bf1f7cbe28762

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Jul 2023 13:25:47 GMT
server: nginx
etag: W/"64ad585b-17893"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 28 Nov 2023 06:00:48 GMT

GET
H2 200 dc_pre=CILasbDA44IDFT1GkQUdAjsEFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3071346376753.8027
adservice.google.com/ddm/fls/z/ Frame D73B 42 B
107 B 47ms
46ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CILasbDA44IDFT1GkQUdAjsEFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3071346376753.8027

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CILasbDA44IDFT1GkQUdAjsEFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3071346376753.8027?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CNmxsrDA44IDFUhGkQUdUzMHnQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2864981555819.912
adservice.google.com/ddm/fls/z/ Frame 549D 42 B
107 B 45ms
45ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNmxsrDA44IDFUhGkQUdUzMHnQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2864981555819.912

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNmxsrDA44IDFUhGkQUdUzMHnQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2864981555819.912?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899E
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEJEscIFGAGkr4RpC2MKBQN4&google_cver=1&google_push=AXcoOmQWB2brnM9LIIMlL3TiIzzR3FDEDGkdAMK1MibVNkam3v6gLxXv4yiDQQpZdfbGsLX1XPts1zr1SGUTi7HuC5YBstcNRvg9
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=511CC608EEE84B70A0464EAB464484A0&google_push=AXcoOmQWB2brnM9LIIMlL3TiIzzR3FDEDGkdAMK1MibVNkam3v6gLxXv4yiDQQpZdfbGsLX1XPts1zr1SGUTi7H...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=511CC608EEE84B70A0464EAB464484A0&google_push=AXcoOmQWB2brnM9LIIMlL3TiIzzR3FDEDGkdAMK1MibVNkam3v6gLxXv4yiDQQpZdfbGsLX1XPts1zr1SGUTi7HuC5YBstcNRvg9

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Nov 2023 06:00:48 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=511CC608EEE84B70A0464EAB464484A0&google_push=AXcoOmQWB2brnM9LIIMlL3TiIzzR3FDEDGkdAMK1MibVNkam3v6gLxXv4yiDQQpZdfbGsLX1XPts1zr1SGUTi7HuC5YBstcNRvg9
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 26 Nov 2023 06:00:48 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899E
Redirect Chain

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEMgUxg_cpos7g_iNhPcWf38&google_cver=1&google_push=AXcoOmTUChFmJCXPHIigKBj095r7QSCs6G9aa0HInf21jGB_kwUrqi8jbNOV8OcA6HzH3ZYTPLD0Uij4lqwi2t...
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmTUChFmJCXPHIigKBj095r7QSCs6G9aa0HInf21jGB_kwUrqi8jbNOV8OcA6HzH3ZYTPLD0Uij4lqwi2tZpgL4ZX8cy77SX&google_hm=hmVkMJC4SiGWaAEKP...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmTUChFmJCXPHIigKBj095r7QSCs6G9aa0HInf21jGB_kwUrqi8jbNOV8OcA6HzH3ZYTPLD0Uij4lqwi2tZpgL4ZX8cy77SX&google_hm=hmVkMJC4SiGWaAEKPw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65643090B84A219668010A3FBLIS

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmTUChFmJCXPHIigKBj095r7QSCs6G9aa0HInf21jGB_kwUrqi8jbNOV8OcA6HzH3ZYTPLD0Uij4lqwi2tZpgL4ZX8cy77SX&google_hm=hmVkMJC4SiGWaAEKPw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65643090B84A219668010A3FBLIS
date: Mon, 27 Nov 2023 06:00:48 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899E
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSO0T...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSO0Tf1sv32QJSnxRF3R-v6YS_5UqtMmPPrKULqBZJ834zHuheawmpFz69vT47ewjrzL7mqvaKIIdeX...

170 B
188 B

20ms
20ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSO0Tf1sv32QJSnxRF3R-v6YS_5UqtMmPPrKULqBZJ834zHuheawmpFz69vT47ewjrzL7mqvaKIIdeXw7VKczKbcctEeFoN

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSO0Tf1sv32QJSnxRF3R-v6YS_5UqtMmPPrKULqBZJ834zHuheawmpFz69vT47ewjrzL7mqvaKIIdeXw7VKczKbcctEeFoN
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 515879
content-length: 0
expires: Mon, 27 Nov 2023 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 899E 43 B
94 B 16ms
15ms Image
image/gif 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESELThMTheH4DK4FvvuhUilfs&google_cver=1&google_push=AXcoOmTEce-kyIlHq1gTgaOMeK9a4fCOsX7P-uWFniNZts-TTuCwiNUL99HLPqmqL_gv5WAwpB4olaqBDR1p52DuE92WVGusQHbq
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899E
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEHIeU719eFLZdU8tyAbQUpI&google_cver=1&google_push=AXcoOmTVa1MvVRmh3qb8VcSYo-E2WNlYlMVzHC1LgQncil749wAbAg2WqcMZf2ckS8lf1vSVqIZow6oVhFN1afe...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=OSdrsg9TVENLHBBdZCgdJlFfBSg&google_push=AXcoOmTVa1MvVRmh3qb8VcSYo-E2WNlYlMVzHC1LgQncil749wAbAg2WqcMZf2ckS8lf1vSVqIZow6oVhFN1af...

170 B
188 B

22ms
21ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=OSdrsg9TVENLHBBdZCgdJlFfBSg&google_push=AXcoOmTVa1MvVRmh3qb8VcSYo-E2WNlYlMVzHC1LgQncil749wAbAg2WqcMZf2ckS8lf1vSVqIZow6oVhFN1afeHWzCoPDe9m9ic

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=OSdrsg9TVENLHBBdZCgdJlFfBSg&google_push=AXcoOmTVa1MvVRmh3qb8VcSYo-E2WNlYlMVzHC1LgQncil749wAbAg2WqcMZf2ckS8lf1vSVqIZow6oVhFN1afeHWzCoPDe9m9ic
Date: Mon, 27 Nov 2023 06:00:49 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899E
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGEXefZq3peqMJASz7o3r4I&google_cver=1&google_push=AXcoOmRqZ8Lp0_WN3nkiIp5YMz5q1RK1eBlDCsiK83mIFP-MnlD8LMnQbLYjWJq7pxXhfKgNZ-9...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBHSTM5UFgtTC1CNkFK&google_push=AXcoOmRqZ8Lp0_WN3nkiIp5YMz5q1RK1eBlDCsiK83mIFP-MnlD8LMnQbLYjWJq7pxXhfKgNZ-9T7FchuYe9QdfUH3RJqx6ofXUC

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBHSTM5UFgtTC1CNkFK&google_push=AXcoOmRqZ8Lp0_WN3nkiIp5YMz5q1RK1eBlDCsiK83mIFP-MnlD8LMnQbLYjWJq7pxXhfKgNZ-9T7FchuYe9QdfUH3RJqx6ofXUC

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBHSTM5UFgtTC1CNkFK&google_push=AXcoOmRqZ8Lp0_WN3nkiIp5YMz5q1RK1eBlDCsiK83mIFP-MnlD8LMnQbLYjWJq7pxXhfKgNZ-9T7FchuYe9QdfUH3RJqx6ofXUC
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: aca6c52e983509e86b136a052e19be23
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 899E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmS0SiJLNyjuEKtn-JYJXUB8YmD_CMcbt...

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmS0SiJLNyjuEKtn-JYJXUB8YmD_CMcbtMViEIrnaCj-lUoDvO6iFlcKXCwy6XN6LTX90sFNLX8LZH2HGsZb9HNxNDrSe64

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pAmMO3qdkLAitDBqNvsuAOqXuo3Qz1uHQk5PdI5hAnnZOZcLX7YfB42bV2vnaAXKnh8EzsJJD4lgmqlbNecl97SSMYVut%2FZpcXJ9Is4lc0m7znOxrCIMEisD6F8rkQPdVfmZmsqN3DJdrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmS0SiJLNyjuEKtn-JYJXUB8YmD_CMcbtMViEIrnaCj-lUoDvO6iFlcKXCwy6XN6LTX90sFNLX8LZH2HGsZb9HNxNDrSe64
cache-control: no-cache
cf-ray: 82c827295cc33836-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 899E 0
12 B 14ms
14ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IdPbFoQGoh9gGybcbw65eRFrGvJh3ZEpmYZASG3WVu07a0jAQhE8UX_TF882Tfx8O7bUFF

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal900017.redintelligence.net/ Frame 4B52 0
150 B 21ms
8ms Script
text/html 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/viewability?s=71561800017758104444550012521017&a=f09f57ac&vb=m
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=71561800017758104444550012521017&a=98b6eeef
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/request_content.php?s=71561800017758104444550012521017&a=98b6eeef
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4EDC
Redirect Chain

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEMgUxg_cpos7g_iNhPcWf38&google_cver=1&google_push=AXcoOmTrCXVGjW9u1Na1Srp09verTeunLYmCCDt_ylUz2CkE4X1549QJ8kNkcEE5nKzkPPQV6D9t6TKLWXn7rE...
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmTrCXVGjW9u1Na1Srp09verTeunLYmCCDt_ylUz2CkE4X1549QJ8kNkcEE5nKzkPPQV6D9t6TKLWXn7rEJBh10Wy63ncQ&google_hm=hmVkMJC4SiGWaAEKPw&...

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmTrCXVGjW9u1Na1Srp09verTeunLYmCCDt_ylUz2CkE4X1549QJ8kNkcEE5nKzkPPQV6D9t6TKLWXn7rEJBh10Wy63ncQ&google_hm=hmVkMJC4SiGWaAEKPw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65643090B84A219668010A3FBLIS

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmTrCXVGjW9u1Na1Srp09verTeunLYmCCDt_ylUz2CkE4X1549QJ8kNkcEE5nKzkPPQV6D9t6TKLWXn7rEJBh10Wy63ncQ&google_hm=hmVkMJC4SiGWaAEKPw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65643090B84A219668010A3FBLIS
date: Mon, 27 Nov 2023 06:00:48 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4EDC
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECrrXA5qK-fMnYRbchtvjHQ&google_cver=1&google_push=AXcoOmSc6nPq7Wwy3xTiyvl5l95qYEwy7zGC-VKG22QSuwt6pq1lBujOcKi4DVzVqqUB4_RTiPyIlDv3Mef8cV3uksKY0SJQKQ
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSc6nPq7Wwy3xTiyvl5l95qYEwy7zGC-VKG22QSuwt6pq1lBujOcKi4DVzVqqUB4_RTiPyIlDv3Mef8cV3uksKY0SJQKQ&google_hm=eS1KczIuUWJkRTJwSHhTRmZo...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSc6nPq7Wwy3xTiyvl5l95qYEwy7zGC-VKG22QSuwt6pq1lBujOcKi4DVzVqqUB4_RTiPyIlDv3Mef8cV3uksKY0SJQKQ&google_hm=eS1KczIuUWJkRTJwSHhTRmZoNGh1dXZQYlhpWlVGLnBZYX5B

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Nov 2023 06:00:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSc6nPq7Wwy3xTiyvl5l95qYEwy7zGC-VKG22QSuwt6pq1lBujOcKi4DVzVqqUB4_RTiPyIlDv3Mef8cV3uksKY0SJQKQ&google_hm=eS1KczIuUWJkRTJwSHhTRmZoNGh1dXZQYlhpWlVGLnBZYX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4EDC
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSt_R...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSt_RJOiejEbkbOU_UPxC-3MNOGEmXnnOxBJLtGRl4bIKF0-TCuNXHe3GD40sbtUfsgRwr2zI7M017h...

170 B
188 B

19ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSt_RJOiejEbkbOU_UPxC-3MNOGEmXnnOxBJLtGRl4bIKF0-TCuNXHe3GD40sbtUfsgRwr2zI7M017hdFymq8V5AsZBt8o

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSt_RJOiejEbkbOU_UPxC-3MNOGEmXnnOxBJLtGRl4bIKF0-TCuNXHe3GD40sbtUfsgRwr2zI7M017hdFymq8V5AsZBt8o
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 592647
content-length: 0
expires: Mon, 27 Nov 2023 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 4EDC 43 B
58 B 22ms
21ms Image
image/gif 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESELThMTheH4DK4FvvuhUilfs&google_cver=1&google_push=AXcoOmQIy2SizhRV7UpjR5zJl6EwrH1nwqscQ7Jm0zrceg6sTSMFnz4zd5zHMNpfOYwtrfZSz-7RAIsgfYeBLaOcxKBCWjR0lg
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4EDC
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEHIeU719eFLZdU8tyAbQUpI&google_cver=1&google_push=AXcoOmRyyunECF0gwSUdNd_WcosHQIZN2eAgkL_jDw75W_uImyKuKq0lguos2u4cDVHUMK7H9qgIxspqJtHRaVH...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=OSdrsg9TVENLHBBdZCgdJlFfBSg&google_push=AXcoOmRyyunECF0gwSUdNd_WcosHQIZN2eAgkL_jDw75W_uImyKuKq0lguos2u4cDVHUMK7H9qgIxspqJtHRaV...

170 B
188 B

16ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=OSdrsg9TVENLHBBdZCgdJlFfBSg&google_push=AXcoOmRyyunECF0gwSUdNd_WcosHQIZN2eAgkL_jDw75W_uImyKuKq0lguos2u4cDVHUMK7H9qgIxspqJtHRaVHMk6XSvIiR72A

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=OSdrsg9TVENLHBBdZCgdJlFfBSg&google_push=AXcoOmRyyunECF0gwSUdNd_WcosHQIZN2eAgkL_jDw75W_uImyKuKq0lguos2u4cDVHUMK7H9qgIxspqJtHRaVHMk6XSvIiR72A
Date: Mon, 27 Nov 2023 06:00:49 GMT
Connection: keep-alive
Content-Length: 241
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4EDC
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGEXefZq3peqMJASz7o3r4I&google_cver=1&google_push=AXcoOmT-ANsXQboBWcR6z_k0GoPxFph-paZW03eQbPe1VIMIKPaYQ81z2y_hS8oFMQ15QH6SDO4...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBHSTM5UTYtNy1JTjBV&google_push=AXcoOmT-ANsXQboBWcR6z_k0GoPxFph-paZW03eQbPe1VIMIKPaYQ81z2y_hS8oFMQ15QH6SDO4D2tOweuyzDjozUvmE4pZfrA

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBHSTM5UTYtNy1JTjBV&google_push=AXcoOmT-ANsXQboBWcR6z_k0GoPxFph-paZW03eQbPe1VIMIKPaYQ81z2y_hS8oFMQ15QH6SDO4D2tOweuyzDjozUvmE4pZfrA

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBHSTM5UTYtNy1JTjBV&google_push=AXcoOmT-ANsXQboBWcR6z_k0GoPxFph-paZW03eQbPe1VIMIKPaYQ81z2y_hS8oFMQ15QH6SDO4D2tOweuyzDjozUvmE4pZfrA
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: aca6c52e983509e86b136a052e19be23
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4EDC
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmRCzaz-nDmw2WxeS6TvJBrt7mSNmJt0N...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmRCzaz-nDmw2WxeS6TvJBrt7mSNmJt0NaXsyhNIkBlyfy7nHom0Lr0Qb0c-OCeM2eA2hevcV274svWk9v4tcO4syHTGOQ

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pO5dfvAXMyss%2BpxbsdhgoY6YOo2ljvdpEgRKuPa0dYsoj7%2FGmsXroi2hUcuEuojdYZdG%2FbNtoY6b%2F0iphCL1PBB8clJNETl5DLssu8%2FcInGibSrmu3t2YHkGGX6aPRgz8IaOGScPBwRBBA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmRCzaz-nDmw2WxeS6TvJBrt7mSNmJt0NaXsyhNIkBlyfy7nHom0Lr0Qb0c-OCeM2eA2hevcV274svWk9v4tcO4syHTGOQ
cache-control: no-cache
cf-ray: 82c827297cf23836-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4EDC 0
12 B 15ms
14ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IctUz48tBqu5SNDtuM93jqadmIUedUX0-8VfRu3CRt2IFJq4F_JTgck9WUXlsHQ-1lLpNd

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 4597 14 KB
15 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90006.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 12:44:49 GMT
x-content-type-options: nosniff
age: 148559
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 12:44:49 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 4597 15 KB
15 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90006.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 20:59:44 GMT
x-content-type-options: nosniff
age: 118864
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 20:59:44 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame D472 53 KB
19 KB 66ms
14ms Script
application/javascript 18.66.147.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=71561800017758104444550012521017&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-120.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:26:49 GMT
content-encoding: gzip
via: 1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 48840
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: tApzatu-q_e_IVHYqXFBAg-m7HlFwOa1faK3zlBXNzwUypLTS1e6pw==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame D472 85 B
439 B 32ms
7ms Image
image/gif 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1701065148&Signature=DpzWcMWqdqmjXStAlZkQllyqU0z8gLaP8RxKOqrAmMx2dE9bhVEHxmpTgHXkrOS15w1YNDoHyOVZIxvoguhC9-gkVtNGUvRVfahVP~5ZgwN1ut6Yy~hxszgILXn9yjjDJaAr8v3goUde~fZf4i2MGlwYr2E1Nxfa5psbdHjZbGGouGTpYKs0bUuAtI~GCue9jHeoGNjoL6x4tJNsJ-laURqe0nm2NFvBg0G0G4GdhkbhdIwOO~OqEbAxyDaA8wL3Wxd5e-WJVh4eArEIIzyE2znvrZkw611zPXUlK8gUajfzx0hnrPpmJLUR6fRbnm9iGFsdwGS0wenixeRQgZu3pg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 26 Nov 2023 15:35:33 GMT
via: 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 56410
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: hthtNOURGp97PJzKSmhkLXZGBegC0u9aRMVjZojl75OxjDPb7qRpaw==

GET
H/1.1 200
OK viewability Show response
hal900017.redintelligence.net/ Frame 1171 0
150 B 21ms
8ms Script
text/html 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/viewability?s=88729800017758304445002012521017&a=9825f5d9&vb=m
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=88729800017758304445002012521017&a=6a3d8545
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/request_content.php?s=88729800017758304445002012521017&a=6a3d8545
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:48 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 51CF 53 KB
19 KB 54ms
15ms Script
application/javascript 18.66.147.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=88729800017758304445002012521017&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-120.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:26:49 GMT
content-encoding: gzip
via: 1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 48840
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: d1Hu9loQmFLW1d24vZaS-BVMTwRv1TmvHGQcCwUPsG2OHian04px4A==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame 51CF 85 B
438 B 20ms
8ms Image
image/gif 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1701065148&Signature=DpzWcMWqdqmjXStAlZkQllyqU0z8gLaP8RxKOqrAmMx2dE9bhVEHxmpTgHXkrOS15w1YNDoHyOVZIxvoguhC9-gkVtNGUvRVfahVP~5ZgwN1ut6Yy~hxszgILXn9yjjDJaAr8v3goUde~fZf4i2MGlwYr2E1Nxfa5psbdHjZbGGouGTpYKs0bUuAtI~GCue9jHeoGNjoL6x4tJNsJ-laURqe0nm2NFvBg0G0G4GdhkbhdIwOO~OqEbAxyDaA8wL3Wxd5e-WJVh4eArEIIzyE2znvrZkw611zPXUlK8gUajfzx0hnrPpmJLUR6fRbnm9iGFsdwGS0wenixeRQgZu3pg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=88729800017758304445002012521017&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 26 Nov 2023 15:35:33 GMT
via: 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 56410
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: YvuZyCjsLF_svvLSh33cgpPSrQHBTqKAB8mePxbgicxjt5fjZQLy_Q==

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 0090 53 KB
19 KB 46ms
8ms Script
application/javascript 18.66.147.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=78339700016663304444994012521006&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-120.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:26:49 GMT
content-encoding: gzip
via: 1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 48840
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 5kEGgXTXsPprX-nbnJD8NMq-X7imiNXxtwpz0fssJrVCUXI4FuhiTA==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame 0090 3 KB
3 KB 21ms
8ms Image
image/png 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1701065148&Signature=ZYK5~eMbpRLxS84pFMnOPSZ92iyIryXp48ElYW2Iv3Eiazk5Mox6CtfoxwJ7F2Vq9G9lrOiwd-9frcXnwswji6NMM8a1bJWXFsmvZdhDu-anEFaCwhki~OkY6l7cWLqPieiTGBiuQ23-xsBXU-Th9n1md-E1tdHDJImey4hCwvPRvx2tk5T13tRsN6PJgQV2dzcWUZeank~nFEnh32RrRo8ynBFtlCnfLd3ry1NsI30n4ElsLR-UPy4EHNsum1nZrPVS3Iy2eGjhmdotkZsWmxmgllUmmpFg~SGXEmrh4Rr9R8YMGko9tOGzHJT5hh8-t4FRGkqDPJibqF6GQrYOPg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Mon, 27 Nov 2023 04:06:25 GMT
via: 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 6864
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: ksswDLj3wx-tz1If44Lm5xFo9MAMIECMJXxMM-Gb3iqFobck14Dv0w==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 7FFA 273 KB
91 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d20db79105726e1f014c79b6721e152a1659729629d13d031c8e5cf3b5e9f2e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92875
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 2F6C
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=simcast.com&sn=ChromeSyncframe&so=3&topUrl=simcast.com&bundle=yMuVdV9tOEswM2xTNDh2MmhIdGxsUlR6eiUyQmoyQUNiaiUyRkkzcWZMaWI5dW1yQlNIQnllNHY5...
https://mug.criteo.com/sid?cpp=GbN_xnxYVVJVNG90R3piU1JacTBMZ3hyV1hDd0w2ZHNGcE4zVHd5M1VjLzFwMVBDMlZNVWxuVlVvSlQ2ZW41clE0L1VwRHowZmdWNUd1eTRVVC9QQk5lZGtKRGZCcUVwVkx5MjF0Ymh0VDRGeDdhSVBWNmpOWXlCdzJ6Nl...

446 B
658 B

14ms
14ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=GbN_xnxYVVJVNG90R3piU1JacTBMZ3hyV1hDd0w2ZHNGcE4zVHd5M1VjLzFwMVBDMlZNVWxuVlVvSlQ2ZW41clE0L1VwRHowZmdWNUd1eTRVVC9QQk5lZGtKRGZCcUVwVkx5MjF0Ymh0VDRGeDdhSVBWNmpOWXlCdzJ6NlZGR3FmY01jYlJkQUdzZjQvdXBjUmVvNTZzMUZiYXFESnlhT2l1UTUzRlRvMCtJZk1VUzJKdFNQTVE2dlZZNlducVVNWnllck9rSDdkWkZDT3BMUU9ZQk1ka3VCcm8wOEl4OUhNMGdsL3JtMkp5T3JqN3F3cUlhYlhlNzVVUUtSaHdBazdhOGQ5VjlGQVg2RmwwbFNzbnQ0c2VDS1BXZz09fA&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5316e2fc2171999885da46dfeb8273c199d4359a5fb056a4e48d04f99b5626e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:47 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 813564
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=GbN_xnxYVVJVNG90R3piU1JacTBMZ3hyV1hDd0w2ZHNGcE4zVHd5M1VjLzFwMVBDMlZNVWxuVlVvSlQ2ZW41clE0L1VwRHowZmdWNUd1eTRVVC9QQk5lZGtKRGZCcUVwVkx5MjF0Ymh0VDRGeDdhSVBWNmpOWXlCdzJ6NlZGR3FmY01jYlJkQUdzZjQvdXBjUmVvNTZzMUZiYXFESnlhT2l1UTUzRlRvMCtJZk1VUzJKdFNQTVE2dlZZNlducVVNWnllck9rSDdkWkZDT3BMUU9ZQk1ka3VCcm8wOEl4OUhNMGdsL3JtMkp5T3JqN3F3cUlhYlhlNzVVUUtSaHdBazdhOGQ5VjlGQVg2RmwwbFNzbnQ0c2VDS1BXZz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 307528
content-length: 0
expires: 0

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 1171 14 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900017.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 12:44:49 GMT
x-content-type-options: nosniff
age: 148559
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 12:44:49 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 1171 15 KB
15 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900017.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 20:59:44 GMT
x-content-type-options: nosniff
age: 118864
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 20:59:44 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 59AE 273 KB
91 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5fc1de4643344535a84e5f45413e024c7fc3ed5647be8702e75da9f3cce57362

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92856
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 80D4 273 KB
91 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a97805dc37ae178689693e4505cae6f56fd43633f23f50798448b2c666b1a549

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92856
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame EA79 273 KB
91 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d20db79105726e1f014c79b6721e152a1659729629d13d031c8e5cf3b5e9f2e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92875
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 06:00:48 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1F23 0
20 B 45ms
45ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BDqF0kDBkZcqXHufkx_APlLaR8AwAAAAAOAHgBAI&bg=!Z2SlZCvNAAZxrfrxUa07ADQBe5WfOGO8V1yZ0_p_wNP25oIErM-Y8EiYJ8UoVzvxotqX4BEL09m8VmCRj6C1uQdcgCTwAgAAAS1SAAAAAWgBB5kC_kXJfUVGlBcbaGcw22rOIem4MoR4T2bZbF9Oo9ectOf_yrrcLJb88pz42ABCNTs1wT3AlUgHfsPV2Ueu4gyBPfIeU8QNjrbQCgI88BG5nTh4ZQphlCK6ib7sNsFLoDcWa1WPg6VOqveGqkKFuwqDAYEWYVNn6aZJGpHwzmkAyP88znr1JZmyGDJOtBSHjBNdBx05YSZTGcLZ267hOouqQzNyrbVBip23KcASCF1P-su4yi_BU3ehfMlSyYk65QosQxMDIDg9N9Dh60zQeFEQ53mt9qfo0t50chLo78nM140bs3Kse5EvkTtOT-JgbjzcP5xtFqsVXgZvANq3RJEu7SWqQs1FRMuXAqw0UdSu5-MRhATP4xowC1dzX_hEP2RpzW-WMv1RfdgVYX08h7Ygkm_cwIaLHZ34VCKi_07lUiyWsC_1GTDFVBHRUQicRBugs5tZJi2cTs1beD9tx5RDul-ITtTQp7ncbWq-0BNgamxRboLgMPAQ011sCrZ44zle35kphZXXGQl4J25CR2XNhwwln9jrXEh_gOJcGrCRYaOVTO8BTfvABcc1pM0B0yLxyakhloKDt0DJVB3ZRwpkX58hqd6xR7nV05d63iEMwAE_LDKhmx7GUgQqDXwdNmXDXgAugsMuYe_5caphTWoxCo3Pgbyz_AHkXpbHeV6jCfaub0-FGql-RgAr-svmMHyhH5IjGpTRnK8SivIbWs-hNELOyxCuN8ObEEVV8Y5py306gOtyYL1G6kt2tuOnFb89Jsv7dhigemjMf94Rh4OQ3UoKWvQATbF_OnvxaEysCRMtmTJSQG_qREapZ0UiT93dYmjTHaAw6ehDhiqKMZiveoeJa2ASEjHxgLD9_lmjctd--a9Z2GSKm0Np3mDeH94U5k0pMpnBfwnDpYKi88dXakreeiDhR0y2mSUehtV3l3U3xicjVBw1fpVG-ygTUT-4jgODLpSKtS0ZvJCgF6AMA5_6Xmo5qVOPh-viH7stHGU-5wx-bZuOxLLPa-sT8_Q

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame D9F3 2 KB
2 KB 68ms
68ms Script
text/html 3.11.123.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=18540500016874104444994012521015&nw=1
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.123.127 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-123-127.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: ecdcb745c39291c268acf1d76eb5a15c837785e0e6891da2ab2a8ead3f04a0ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
last-modified: Mon, 27 Nov 2023 06:00:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Mon, 27 Nov 2023 06:01:48 GMT

GET
H3

200

activityi;dc_pre=CJXCwrDA44IDFb1KkQUdUpQDFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=11172271118.486954 Show response
5994599.fls.doubleclick.net/ Frame 2615
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=11172271118.486954?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CJXCwrDA44IDFb1KkQUdUpQDFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=11172271118.486954?

392 B
241 B

50ms
50ms

Document
text/html

142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CJXCwrDA44IDFb1KkQUdUpQDFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=11172271118.486954?

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77fefe71b2b82529ae18d769dea78a8cc228967b1a095ffef954d1bb92ada9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:49 GMT
expires: Mon, 27 Nov 2023 06:00:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 06:00:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJXCwrDA44IDFb1KkQUdUpQDFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=11172271118.486954?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900015.redintelligence.net/ Frame CE5F 7 KB
2 KB 19ms
7ms Document
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/request_content.php?s=18540500016874104444994012521015&a=fe96f97a
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 St. Ingbert, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f9b63f05315f491c72ab69bd80dd9e23c6351c90ede379f73e128713f2fb4f67

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2121
Content-Type: text/html; charset=utf-8
Date: Mon, 27 Nov 2023 06:00:48 GMT
Expires: Mon, 27 Nov 2023 06:00:49 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D577 1 KB
643 B 7ms
6ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 74133
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 09:25:15 GMT
etag: 48472445140208031
expires: Mon, 27 Nov 2023 09:25:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D9F3 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99401e5374afd9444cc0f6c6b6584d888df5cebcd7f443e05d1960e70badeed4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame CE5F 5 KB
682 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=18540500016874104444994012521015&a=fe96f97a

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 27 Nov 2023 06:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 04:23:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Nov 2023 06:00:49 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame CE5F 13 KB
13 KB 21ms
9ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=18540500016874104444994012521015&a=fe96f97a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: ce54602423b934e22b74d418617094c9a35690afc8bb08ef6255adb166e9e125

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12996
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame CE5F 17 KB
17 KB 20ms
8ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=18540500016874104444994012521015&a=fe96f97a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 9149d214e2f1e2a3ae0dc58697504d743bd677afbe7685f74ab5eb72359d97a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame CE5F 16 KB
16 KB 23ms
8ms Image
image/png 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=18540500016874104444994012521015&a=fe96f97a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: d92a084f754386d657e935721ef3060c78b0bed045c1eb6ce52b870b82653383

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16512
Vary: Accept-Encoding
Content-Type: image/png

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
264 B 110ms
109ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Znd%2F%2BzqO1OGxaVXm4vgyin%2B%2FVLxLXwJBFUrKYq3W4mML2iVNCCb9Mt93lH3I%2BsWeLue04WHyayrI1A5vvcm4xka5dCtBqZB6z03GHyETtqc6WvH3a%2FYRUGSgmB0ILOPXv%2F1Y9TgpvB5t1537CFo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c8272b2f576931-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 102ms
101ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c8272a8ee96931-FRA
date: Mon, 27 Nov 2023 06:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iWP4has1tWoSR%2FyfLtqMqMWSfaYQ8ifFctQ72CLHyXS3MkUsasbjKx2BBmH0nFnm%2FcoFAojSDmGE08xXXQW1JABhGZkdJy7iR9kiIofOK6Js7BoZycacJMVWQ0L03QA47NowvMqf4frR%2B1ZCiug%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D577
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEJEscIFGAGkr4RpC2MKBQN4&google_cver=1&google_push=AXcoOmRKjKDc4Gqnb9kPWuLPOvoo3Z24DXF-863X8ZqpfG0TiqxtvIDs-445ECaR27ShGv9jwNpZO7i72oIBiDCSltAIIkb1e6rz
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=511CC608EEE84B70A0464EAB464484A0&google_push=AXcoOmRKjKDc4Gqnb9kPWuLPOvoo3Z24DXF-863X8ZqpfG0TiqxtvIDs-445ECaR27ShGv9jwNpZO7i72oIBiDC...

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=511CC608EEE84B70A0464EAB464484A0&google_push=AXcoOmRKjKDc4Gqnb9kPWuLPOvoo3Z24DXF-863X8ZqpfG0TiqxtvIDs-445ECaR27ShGv9jwNpZO7i72oIBiDCSltAIIkb1e6rz

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Nov 2023 06:00:49 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=511CC608EEE84B70A0464EAB464484A0&google_push=AXcoOmRKjKDc4Gqnb9kPWuLPOvoo3Z24DXF-863X8ZqpfG0TiqxtvIDs-445ECaR27ShGv9jwNpZO7i72oIBiDCSltAIIkb1e6rz
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 26 Nov 2023 06:00:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D577
Redirect Chain

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEMgUxg_cpos7g_iNhPcWf38&google_cver=1&google_push=AXcoOmTrAVnw4wlk6YdkxrdaCOikt3Szr06kGbYfOk5tdSdytfmBTjKnBLadv3jPElR_UYH3f4DKRnnCKkLWU8...
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmTrAVnw4wlk6YdkxrdaCOikt3Szr06kGbYfOk5tdSdytfmBTjKnBLadv3jPElR_UYH3f4DKRnnCKkLWU8gg0tw2S1fZK89k&google_hm=hmVkMJC4SiGWaAEKP...

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmTrAVnw4wlk6YdkxrdaCOikt3Szr06kGbYfOk5tdSdytfmBTjKnBLadv3jPElR_UYH3f4DKRnnCKkLWU8gg0tw2S1fZK89k&google_hm=hmVkMJC4SiGWaAEKPw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65643090B84A219668010A3FBLIS

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmTrAVnw4wlk6YdkxrdaCOikt3Szr06kGbYfOk5tdSdytfmBTjKnBLadv3jPElR_UYH3f4DKRnnCKkLWU8gg0tw2S1fZK89k&google_hm=hmVkMJC4SiGWaAEKPw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65643090B84A219668010A3FBLIS
date: Mon, 27 Nov 2023 06:00:49 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D577
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESECrrXA5qK-fMnYRbchtvjHQ&google_cver=1&google_push=AXcoOmSPW5AtY8lE3yhvVSYxClfrq_zUbAXH0uiHFeO78HSaGWzD898kRhULXRSiZI1ItVu_1jCYGn_xI-3be4G-rMgt14g...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSPW5AtY8lE3yhvVSYxClfrq_zUbAXH0uiHFeO78HSaGWzD898kRhULXRSiZI1ItVu_1jCYGn_xI-3be4G-rMgt14ggZune&google_hm=eS1KczIuUWJkRTJwSHhTRm...

170 B
188 B

20ms
20ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSPW5AtY8lE3yhvVSYxClfrq_zUbAXH0uiHFeO78HSaGWzD898kRhULXRSiZI1ItVu_1jCYGn_xI-3be4G-rMgt14ggZune&google_hm=eS1KczIuUWJkRTJwSHhTRmZoNGh1dXZQYlhpWlVGLnBZYX5B

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Nov 2023 06:00:49 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSPW5AtY8lE3yhvVSYxClfrq_zUbAXH0uiHFeO78HSaGWzD898kRhULXRSiZI1ItVu_1jCYGn_xI-3be4G-rMgt14ggZune&google_hm=eS1KczIuUWJkRTJwSHhTRmZoNGh1dXZQYlhpWlVGLnBZYX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D577
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSDZK...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSDZK2-n4GMmpZoo4wz85gK2cUzQF7psZ5WbMfKZwZJfuMmbmOa3y-qXREsJOsm4sFOjY4k5Qz_WxLc...

170 B
188 B

20ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSDZK2-n4GMmpZoo4wz85gK2cUzQF7psZ5WbMfKZwZJfuMmbmOa3y-qXREsJOsm4sFOjY4k5Qz_WxLcnDelyFvlVpRHmgtG

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:48 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=k--BLkhrJNMTvLAaNuHuNa4dbS--TKch6ceBx-rQ&google_push=AXcoOmSDZK2-n4GMmpZoo4wz85gK2cUzQF7psZ5WbMfKZwZJfuMmbmOa3y-qXREsJOsm4sFOjY4k5Qz_WxLcnDelyFvlVpRHmgtG
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 729300
content-length: 0
expires: Mon, 27 Nov 2023 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame D577 43 B
58 B 18ms
15ms Image
image/gif 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESELThMTheH4DK4FvvuhUilfs&google_cver=1&google_push=AXcoOmSEsr63b5gVAu6wIOrcbXK2esABXlS7DzuBFaS1eLQb6JwV8kjsi3cyHSmBi0qnaIaR8w_tg9F33v9tSuqw5-7TOa9dcEQH
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D577
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGEXefZq3peqMJASz7o3r4I&google_cver=1&google_push=AXcoOmTzitGg_BX333loYaVjT-WNT7KJzvhYPwxsfjd7loyhyDkOmP8VgwW-2XqFL6fAqqGgA_j...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBHSTM5VjYtMjQtMUpWTQ==&google_push=AXcoOmTzitGg_BX333loYaVjT-WNT7KJzvhYPwxsfjd7loyhyDkOmP8VgwW-2XqFL6fAqqGgA_jc36w1VPjyS_wohxMd5nm27Bc6

170 B
188 B

17ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBHSTM5VjYtMjQtMUpWTQ==&google_push=AXcoOmTzitGg_BX333loYaVjT-WNT7KJzvhYPwxsfjd7loyhyDkOmP8VgwW-2XqFL6fAqqGgA_jc36w1VPjyS_wohxMd5nm27Bc6

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBHSTM5VjYtMjQtMUpWTQ==&google_push=AXcoOmTzitGg_BX333loYaVjT-WNT7KJzvhYPwxsfjd7loyhyDkOmP8VgwW-2XqFL6fAqqGgA_jc36w1VPjyS_wohxMd5nm27Bc6
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: aca6c52e983509e86b136a052e19be23
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D577
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmTmzDLECrI4E88Yi5QPzRvWpdQrJLTB2...

170 B
188 B

30ms
29ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmTmzDLECrI4E88Yi5QPzRvWpdQrJLTB2PhrAG_LKpvMi5WDhdtmDQz8GO80XhYfqslkt2LPdF_AB_RYBhj7SGz31c14vjzu

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jgcHMhvPShHz6w%2BOHKVUT6e18kc%2FX2B64t4Zsr4OTm7vSB5AuzTIDjbeWn6d%2F%2BfUwfdHEBYxe4EL5gd5Nz9n%2FyYMCTpeU%2BIT8umv1p0ZTTw%2BQM5Jc%2BiJxYAXsalXUWlysjcurTsJJcwjag%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEPl_W_1Cio3ZeElXWa4WRkk&google_hm=ZWQwkO7IanDqL7c5cx9HfgAAFDIAAAIB&google_nid=index&google_push=AXcoOmTmzDLECrI4E88Yi5QPzRvWpdQrJLTB2PhrAG_LKpvMi5WDhdtmDQz8GO80XhYfqslkt2LPdF_AB_RYBhj7SGz31c14vjzu
cache-control: no-cache
cf-ray: 82c8272abe173836-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D577 0
12 B 19ms
18ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K0DrUktv_4zYUiulNazZi-eOLpKll28A6dchrYmt0mHlqGTUBzfK9_guRndGAA5DW_iZgg

Requested by

Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal900015.redintelligence.net/ Frame CE5F 0
150 B 20ms
7ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/viewability?s=18540500016874104444994012521015&a=72de5020&vb=m
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=18540500016874104444994012521015&a=fe96f97a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 St. Ingbert, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/request_content.php?s=18540500016874104444994012521015&a=fe96f97a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 dc_pre=CJXCwrDA44IDFb1KkQUdUpQDFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=11172271118.486954
adservice.google.com/ddm/fls/z/ Frame 2615 42 B
107 B 44ms
44ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJXCwrDA44IDFb1KkQUdUpQDFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=11172271118.486954

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJXCwrDA44IDFb1KkQUdUpQDFg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=11172271118.486954?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame CE5F 14 KB
15 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900015.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 12:44:49 GMT
x-content-type-options: nosniff
age: 148560
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 12:44:49 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame CE5F 15 KB
15 KB 10ms
10ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900015.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 20:59:44 GMT
x-content-type-options: nosniff
age: 118865
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 20:59:44 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame D9F3 53 KB
19 KB 9ms
7ms Script
application/javascript 18.66.147.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=18540500016874104444994012521015&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-120.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:26:49 GMT
content-encoding: gzip
via: 1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 48841
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: smCAbTWEw8VcESGVsFyt8Eut87d3HGoU630v-eJ-oEX16GlxqRJr7w==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame D9F3 3 KB
3 KB 10ms
8ms Image
image/png 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1701065149&Signature=fcMgwoKZ1BmZxF7GeXmxI9L8GOPcR2ESOeZkBk9-td4DU~pEw5VGTE1L4rCxB7AQXM7-TMcwuztNGe0hy4Hfj8Y5Qv5CMFM44-il6C1ykPF7xhTAQ~gA~DXrlhp5ebLOMWmB2CUmS6NXgAHKo0cMTbmYcWo7afXss5TWiKT0L9wadL2Cv1mrJvGs7qU2rrApiSfJXdQKuszdws7tnOAjApRFty-636tbWE6S8MjNkDJFUoxlWU9IFyk7536ZMnFg0uFiozxjyvgv-d3Sawf-S9muUKp0MLlauxpZUPVYVG7QgPnvhFW~bLvuRuFO3Up8~O7ywueOpjQFScCB0rZ1~g__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
URL: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Mon, 27 Nov 2023 04:06:25 GMT
via: 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 6865
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: nVoxF98b8viNM2P4qeqxTnV-2NYbiMUoqRz1d7DHJnjW6FKh9qnxWQ==

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 7E2F 42 B
64 B 50ms
50ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsur42FkVF4GbX6bbwMnslUtmpOMpEaz7ke6kFvmkdBWfVT_WVGn1rMTNryeURtDqceGCClkcioy-yDY09lr1kFA78JJEJDqwelUWQzotOiQ-NRPjFf8Vee-ohNqNjPJG7rHAk4-3xiNXFaK&sai=AMfl-YS5LR9yZJcjQi5xX-wofEFgyVDrElL6QuR96Re-nzdvtzqjYJdr9EyPzeTxcRRkmdBht0MYKACGJh690hv7YrJV8zwtBO2mJVmIDPs7s8ud4y9nbdZZ0WqsBEjKKqDcDsoIEAqZSpc-zJ3EUI6b&sig=Cg0ArKJSzCh59lsERcrjEAE&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&id=ampim&o=315,310&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=156&tls=1156&g=100&h=100&tt=1156&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 194ms
193ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c8272ce8fb6931-FRA
date: Mon, 27 Nov 2023 06:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mkjufbssgW9jG%2BxKs3hbiS25sDJrpt9DTtlUdgEs62CaJ1EKc1%2BqSWzyGoILAbPuHcAWM0LaNI4KhpRooagoBxlrjXgc20HCH0xtCsWbd3EgEwlaMdKNrPX2I05k%2FamR3LUHRtMxMZFPBIk5dWE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 105ms
104ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c8272ce8fc6931-FRA
date: Mon, 27 Nov 2023 06:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QkJpsJDAY%2Fe1GiSgbGEUArao0wooz%2BqZ3KAzRszL14%2Fi1ZMw8vhowG1WL74jWDb6CG9cWpDmnAu%2FfCnrB1mjSLrQ1gk%2FnSLG9K8zZQi5mFL5QtKMPLzzquG1Z%2B7jSgXZco8xVOxZUPr23dSlGzg%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
261 B 104ms
104ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FAahz%2FlPKz9FoXpQ3LXdga1KumRrDIcVDoSjw9bZ4YqV3SFIlhKKmdU3hMdFFnGmzUbfIRJ45UuBHH4dYMUnsOXNgkN%2FOaIX9FPfvQmFFpisABBb1zV3b1bIU0ewNyh%2FzDfnpHIUSvsuyOysl%2F8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c8272e19c46931-FRA
content-length: 0

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
261 B 108ms
108ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X3aqncBZx7dQZQ1PR1uxGNxs1qVZ5Qk2rGCOyno8pHm4tnCdi%2Ff9XsFc7TJvYDlPz4%2BgX%2FF3au2oNUGdIf29hbbK20O5QrH2EBmQ3LjwmwVohizpdbcGgIuis%2BDkUQLxjw8IGhML%2B3QeZ5zgsv4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c8272d89656931-FRA
content-length: 0

GET
H2 200 inserts.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 127 KB
43 KB 20ms
20ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/inserts.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 462478cd501b11de6f111719b46b8c46375ffeba611413f99b1844814a19eec8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 138
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ILRyxJvrqemvMiiosQoieeERil5lE2%2BW2kwwk2UKy2Qxdb2Y44UeQjukBgN1kNxEP9z8Z25Ubsw67%2FZCCwzOPO0E7jxhU0RepZjPilZaPuUNC5m%2BqMdFlX%2BLcbReWgkTq5uwe9bXrdiMx%2BNa"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c8272ceef7bbfd-FRA

GET
H2 200 p-64ee7c76.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 5 KB
1 KB 15ms
15ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-64ee7c76.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: fc671afb0fb4f987fdba2d42d1712fa4fbddb7f593d6b9ef3a08bf62cfe8ebaa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 138
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pTqnTTgSXdsrvIp%2Fox%2Ft3Mi7NWtiLpbdS3yI54EHRWsxNTN8iA8awWHhLapJnspJ7jIW%2FMh1r%2FOgUQoi%2FchbSCReoKfLw1kNN8KDc1MhzxwllRVr7jeQ7iKWWhXOYVzERF1OUMJ30iup7VFK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c8272d1f28bbfd-FRA

GET
H2 200 p-519aaece.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 18 KB
7 KB 15ms
15ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-519aaece.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 7de421f5fc292856d86cd03dba3ad6bab58657ea6c554221445a834e5fa09649

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 137
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yeWPKq7FxHQPGm9QbhUeHeCs5MW%2B6C0N06wHqKZq218ikMPM%2BlITdPcI7zFq3uu0UTgai68A6Yj5jpSQeFuCC3QiFq8GSKXETA%2FAmeLywUkX%2F7gjARYdK0DOa%2FtMubaUKhfNQBa5qxgdG0Cd"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c8272d3f47bbfd-FRA

GET
H2 200 p-6de0ca0d.system.entry.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 56 KB
14 KB 395ms
395ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-6de0ca0d.system.entry.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 712be1d0391b49ad1764f0a469f88012719b49d17d195f2a8482c7c73d556fa2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rvS5KYFgZ6%2BEAQDKQEoIRfK8BvrrI1v5NDBuSA%2BF5gJdVU%2FRTHAHf7Rp8ayojBC8tjcVPT4SabjmYzfMsrIrg9iUtT8qFYb%2FbAIYk3CsSwdAmW1fm%2BE0dpHs9TLToLnEPdhfAFzp8aZmhh7P"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c8272d5f66bbfd-FRA

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D472 42 B
64 B 43ms
42ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv_wIp7kNKzvUTEYtrLqrFgqGDHeTIUtoTIiD5M84QpFrFLYAwDwDYlUd_tYYguXfLIgJYaRyIdwJXl0IzS15rJFtc_sRJ-fTlENj4dTr5PbPgZqNs1mX6-WZ_UiAcQSls&sai=AMfl-YQKYxqETinMNhxhU6WEwXeYR55NEJx4dNQbJjevKfvU2PdPDmlrZaIqLl9zCWeOZAw4uLTkkV6Xqkqa6QG7oCw0ReBF-J9vKT_uiPUtPurt8y0e4OlqFMVh61f4kaYxbtK2HKeov4sj4LY5URln&sig=Cg0ArKJSzFH6fnlHDuLoEAE&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&id=lidar2&mcvt=1105&p=1110,436,1200,1164&mtos=1105,1105,1105,1105,1105&tos=1105,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=429498904&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701064848242&rpt=497&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 0090 16 B
209 B 61ms
61ms Fetch
application/json 3.10.29.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.10.29.13 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 103ms
22ms Preflight 3.10.29.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.10.29.13 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-10-29-13.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Mon, 27 Nov 2023 06:00:49 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame D472 16 B
209 B 66ms
65ms Fetch
application/json 3.10.29.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.10.29.13 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 77ms
21ms Preflight 3.10.29.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.10.29.13 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-10-29-13.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Mon, 27 Nov 2023 06:00:49 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 51CF 16 B
209 B 71ms
71ms Fetch
application/json 3.10.29.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.10.29.13 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 67ms
21ms Preflight 3.10.29.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.10.29.13 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-10-29-13.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Mon, 27 Nov 2023 06:00:49 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame D9F3 16 B
209 B 75ms
75ms Fetch
application/json 3.10.29.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.10.29.13 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 62ms
21ms Preflight 3.10.29.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.10.29.13 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-10-29-13.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Mon, 27 Nov 2023 06:00:49 GMT
server: nginx

GET
H2 200 p-75fe082c.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 113 KB
40 KB 18ms
18ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-75fe082c.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 27957e60720cb638a200617a862829f7de781662b0872d8632172ee14d224364

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:49 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 137
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xxNHXlpJytupZHC3BufA79jB%2B9V0haVoqV%2BbdzBNKEh5HV9eW7dkhzvu6F4fKiIGeGa0jFzGRABa3PEmJHEXVTD9WKnZCxKBwbB1QqB4fAv7C05cIyiwUbaj6KnJ%2FBOgcMzAwxsIwc3YhwKE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 82c8272ff9d2bbfd-FRA

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 107ms
107ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c827302b6c6931-FRA
date: Mon, 27 Nov 2023 06:00:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FDkDZFuPFvr0%2FtCNewOe4W65oUlx11jrVHXUQbjhKfXq%2BNsxAFGpprvm4IwfUECPIE67XFTGInzhl1Qt1NHZh8CBhrFIuQPMFvn3YHWNaBWq3AXLHVg41gTsr7obTuIaIO%2B30k7Jnatha2aa3Ro%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
259 B 108ms
107ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3kiXc9KAD9l21mLRhuPc1tCILI%2FLqh3xJvD9b%2FdKLs9mMRNQ9OUf6sgJfC1oHdyvpCPtcTeRu%2BnRN5h0v5hf10x%2B1nMaKGOBpsXb6C0pHwD5UQSjTtsiivWF9MEhFospqAcP29aFvo%2BnfgdtHMw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c82730dbed6931-FRA
content-length: 0

GET
H2 200 Generic-BugFlip.png
tags.qortex.ai/assets/inserts/shared/common_images/ 407 B
692 B 207ms
206ms Image
image/png 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/Generic-BugFlip.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 92ef728984670149848a09c8a589b1ca470fe602065dee127c26a0dcab2115a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:15:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B1W92d4IpoJZ8p186Drn6gLvj%2BiHCz1Uxsi%2Fa%2FTKcY65ijO47Cf4S8qJY%2FfWAXVRLuaLI6D9NnzFeXWf8lBHdEVdVwNW3n1xMoii6VFZUjSuKikA%2FpQjK6eSqLWEadsONAeq4WS7R0DQKYHh"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 82c8273029fdbbfd-FRA
content-length: 407

GET
H2 200 PNG_CloseButtonOutline.png
tags.qortex.ai/assets/inserts/shared/common_images/ 1 KB
1 KB 191ms
191ms Image
image/png 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/PNG_CloseButtonOutline.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 430cc3198a26a9b7438c95aeb5ff9ae90437059a690cdd1287c57070f52d2982

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:15:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B0MAyWRTHYWpJb%2BSlLbLaogOdeWBtLvKI58tYBTM%2BIdrvikV8N7deoW6kDMiTlQOXfz%2Bnk3fXdQ%2F83jVIe8zySwQucFIPyR0huSxDuSGCyUCv4oUtg91dxiL%2BOfaJ40H%2FFOrDvZ%2B6XkntHbu"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 82c8273029ffbbfd-FRA
content-length: 1080

GET
H2 200 PNG_CloseButtonBackground.png
tags.qortex.ai/assets/inserts/shared/common_images/ 554 B
865 B 192ms
192ms Image
image/png 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/PNG_CloseButtonBackground.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9e399906113e82fdca498a58d00013adda68308481605fcae2d488772559425f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:13:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oT4f0mSsSOPcJ0WEti%2FZMRz0o43qM%2BoX2bqM76L59cWktVe55XZcC7LZmfrTzhKnisZk844WZd8FsodH%2B5JtgbRM45PovU%2BOREXK39cj3%2BDDt6%2FDUDGEDkJtRZltmQvXExf4yugr51wn6Il%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 82c827302a00bbfd-FRA
content-length: 554

GET
H/1.1 200
OK viewability Show response
hal900017.redintelligence.net/ Frame 4B52 0
150 B 21ms
8ms Script
text/html 159.69.70.9
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900017.redintelligence.net/viewability?s=71561800017758104444550012521017&a=f09f57ac&vb=v
Requested by: Host: hal900017.redintelligence.net
URL: https://hal900017.redintelligence.net/request_content.php?s=71561800017758104444550012521017&a=98b6eeef
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 159.69.70.9 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.9.70.69.159.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900017.redintelligence.net/request_content.php?s=71561800017758104444550012521017&a=98b6eeef
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 045B 281 B
555 B 40ms
7ms Document
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 27 Nov 2023 06:00:50 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 045B 46 KB
13 KB 7ms
7ms Script
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 8d930c2f5a8400c78ce415e91fd9a884d1fdfbe17e511cfdd00537a9550d4a4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 06:00:50 GMT
Content-Encoding: gzip
Last-Modified: Sun, 26 Nov 2023 11:37:55 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=20240
Connection: keep-alive
Content-Length: 13230
Expires: Mon, 27 Nov 2023 11:38:10 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D9F3 42 B
64 B 43ms
43ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssZ_fMHYZMGvrqw0IdAbKNUupNItpvpOLKE4ywZNXAj5omrdgyY-RgOlZImKNMO-JHt2lRU5iDbwrAE2HEMACUQbG6JxBPcmAIlDw3tJ1nUNuOX6aViQ3exIS47nIWISbA&sai=AMfl-YRuekJb_L4ppXSlhvCBNwznSYty8Nmclqag1JQsi1l9fLQyoRsVsSxdz2u_V76R92uBl0giFrMAFbQEaNIlP1a9jseGtsNSdW6KQCgIooaGiqMTBqhtCktGjSbBBrrjmi0EwII40P8jIWGcDw2V&sig=Cg0ArKJSzBfnYQuLtESGEAE&cid=CAQSTgDICaaN9Xw4-ZORm8Q3UB18ijNLIhclm8_amVjP2BzfsWu8N3ZF89tWcFjANR0OIMhQar47lbORD_FfyyBRC2DstFbAmqHr9_rBq8wmWRgB&id=lidar2&mcvt=1003&p=655,1232,935,1568&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=531472206&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701064848236&rpt=760&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 045B 7 B
380 B 33ms
8ms XHR
application/json 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0090 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6962734939121&version=m202309260101&ct=77&x=1&cor=10855745751645034000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D472 0
20 B 37ms
37ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4972230793274&version=m202309260101&ct=77&x=1&cor=18306730554864472000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 51CF 0
20 B 43ms
42ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1306494321026&version=m202311060101&ct=77&x=1&cor=11199176347821187000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D9F3 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1934263553757&version=m202309260101&ct=77&x=1&cor=13111126243688905000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://35f458470e3e50b68ff208633c3ff461.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 06:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 101ms
101ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c827319c9d6931-FRA
date: Mon, 27 Nov 2023 06:00:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mcoBMlaxGfGHW5dpYGG1SerJuXBWoVlENHJiQTGqDDt071AwP%2B3HCYoekslptENYmsqQ8tJcA%2FP4fcVuf73ECWXwnFUKMHUiCf5UOtH4j%2FD025YA2fTiXTNtAU9jkUQs%2FTCmRV824NWAToszxog%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 107ms
107ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c82731acad6931-FRA
date: Mon, 27 Nov 2023 06:00:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jkdd9dyfovR0DfTrhTqCCJVdEhpAIb6SpEkt2JW4j3rmAF6tn8pvuoF9%2B2xKyj86fBnaqphvE8XfEFpPILnzwVaZwlnbIAhPkzfwiyIx7sAX39ALgNaWH6pqemN7gjEtJWtndtzAfYST5UmYJdM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
265 B 101ms
101ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cZVAiX2HPpcx%2BP%2BpIDjlK%2BNeo9rWaiKGllU3lTFfdxaECWJdz1l45mxN4JGmTeGSegl0JEBjDZJu24RFUagIil2zGT1n5cZi1pWKzxus%2B%2Bj4s7iAL0WGqXjHx4Kfc%2Bmq%2FDOg2IcKoRC5xItL0kg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c827324d396931-FRA
content-length: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 53 KB
13 KB 300ms
300ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1377815174196728&correlator=4371593625036136&eid=31079745%2C31079525&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fifs&iu_parts=22181265%2Csmc_cx-on-stream&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=7&sfv=1-0-40&sc=1&cookie=ID%3Df78296c456c2d5a3%3AT%3D1701064847%3ART%3D1701064847%3AS%3DALNI_MZe78oFff5MfGkApyODS5l3_qhq6A&gpic=UID%3D00000cdcd85fd20a%3AT%3D1701064847%3ART%3D1701064847%3AS%3DALNI_MZC_ByCejZ8H1yB-N1iJwz2GyB2Ww&abxe=1&dt=1701064850178&lmt=1701064850&adxs=20&adys=655&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dvodafoneidea.ph%26pcid%3D48%26rid%3D112%26a%3D0&ref=http%3A%2F%2Fvodafoneidea.ph%2F&vis=1&psz=760x-1&msz=760x-1&fws=4&ohw=760&ga_vid=85971985.1701064846&ga_sid=1701064846&ga_hid=378375595&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRid5fb6wDFIAFICCG8SGAoJeWFob28uY29tGKfk9vrAMUgAUgIIbxIZCgp1aWRhcGkuY29tGOTi9vrAMUgAUgIIbxIbCgxpZDUtc3luYy5jb20Y4-L2-sAxSABSAghvEhwKDWNyd2RjbnRybC5uZXQY5OL2-sAxSABSAghvEjsKCnB1YmNpZC5vcmcSJDNjZTlhMzRjLTMxYjMtNDhkOS04MGJlLTI1NWY1NGExOGNmNRjh4vb6wDFIABIdCg5lc3AuY3JpdGVvLmNvbRjQ4vb6wDFIAFICCGQS7gEKCHJ0YmhvdXNlEtgBYkRwdXFHbkVJK0w2SDdwTmg0Y3UzQ3dYSUd0eFNiUW5WWkpCTWo0czFkS01HMDY4UGxtV0t4aVFOSXo0UkZFaW1sMlB2aSttWDFOSEVqckNobWYwNTdmNTgySDgzNjRuLzZNRzRJaVYybWFROTBGODBXTC9sYUcwVjBGc3Q1SXlVTjl0a3FNejNYc2N6VStoSWQ3MGVnQURmd1FDNy94cHVWekp5Q0ZsM1FvZUduQXUxSU5JVlJZVno0RTZSOUpPY2N5MExyUTl1UkVuUjJpZzh0elNkQT09GIDl9vrAMUgAEj4KBW9wZW54EixleUpwSWpvaVNFSkNPRmg1YTJ0VGNqWjFVRXg1UlVsdVkwc3lkejA5SW4wPRi05vb6wDFIABIbCgxsaXZlcmFtcC5jb20Y4-L2-sAxSABSAghvEh0KDmxpdmVpbnRlbnQuY29tGOPi9vrAMUgAUgIIbw..&dlt=1701064845504&idt=643&ppid=3ce9a34c31b348d980be255f54a18cf5&cust_params=gcRTDTest%3Dtrue%26pbstck_ab_test%3Dtrue%26wvr%3D3%26wie%3Dtop%26cndl%3D1%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D200%26wrap_l%3D1700%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D600%26padpr%3D16%2633acrossId%3Dfalse%26amxId%3Dfalse%26criteo%3Dfalse%26hadronId%3Dfalse%26id5Id%3Dfalse%26identityLink%3Dfalse%26liveIntentId%3Dfalse%26lotamePanoramaId%3Dfalse%26pairId%3Dfalse%26quantcastId%3Dfalse%26sharedId%3Dtrue%26teadsId%3Dfalse%26uid2%3Dfalse%26uids%3Dpubcid%26uids_c%3D1%26waai%3D700%26gc_bucket%3DH%26waae%3D1000%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D1s&adks=1969281031&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js?cb=31079745

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d16d556a3a9f3782dc33314c73b16b45979fb3e4eb6f0e6180fdbe855b51f4ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13348
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
260 B 107ms
107ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OfCSFKIBbeuJj08N4Oh6IpVMQ9F6sHBvb7KKafJYtiHoBdiPevjqudKHgPQwkCI3bQgKJqAhCRy51yqPNpXviQdVq0k%2BNjPKIK5y%2FS4j5L%2B3UgJU2PQFzyPuoRwsuJtDUlNpnrIywgXVYWPawd0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c827325d546931-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 200ms
200ms Preflight 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 82c82731acb96931-FRA
date: Mon, 27 Nov 2023 06:00:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=baVJ4apbzYiEnJQaUxmwfAmHwVOEVnP%2FGv8U%2FLWt078qSiE%2FgVrAW8AO%2F3S7VtFvBI35FkhYTeLopgGF5bUC0%2Fp6yK3stMiqm4A8ma%2FmTxH%2Fdo5GJZJ3eV8K5Uzjpan%2FNmruN112q%2BOWfP470QA%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
258 B 100ms
100ms XHR
text/plain 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Nov 2023 06:00:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bZloVlAH4xI8E5yvNTBygP4kz5tAxAsRTIn%2BhusjWOxIfsS8e8M4d9FfibmmcsqNEazpTJtopvEWb3IpEOt42IbyXz6bSH6ssoK%2BQyI5haaZEQJsLiCYb%2FF0efd1V36b%2FZqozD3cqrg1ZysGCqE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 82c82732eda66931-FRA
content-length: 0

POST
H2 204 prebid Show response
ib.adnxs.com/openrtb2/ 0
631 B 14ms
13ms Fetch 185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/openrtb2/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS