femme4.com Open in urlscan Pro
2606:4700:3032::ac43:9947 Public Scan

Software

sffe /

Resource Hash

e60083a2206eb4bb7a2ae8824b173e709ae571a69688dc82ee74f8f8d9ad36e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1026 / 949 of 1000 / last-modified: 1635410443"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27276
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 28 Oct 2021 08:49:41 GMT

GET
H2 200 pre_pws.js Show response
fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/ 534 B
1 KB 37ms
6ms Script
text/javascript 151.101.130.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pre_pws.js?type=default
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 95f2cbf262679817a73625e041af10779dddb0b05c81f0418c4c3b89e5f45e8a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
age: 30837
x-guploader-uploadid: ADPycdsiL9KNTF55NaTxlHPXezy44UWneLpTI8T579qQjJCYBJPvC_LUF48AmH4O59Y2_UQHeiJQ3WLM2oplSp_JdY7QqrNLTw
x-cache: HIT, HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-restarts: 0
x-verify-21-url: /prod/sites/6/7/5/6758a527-c373-49a4-94e6-5a958edc9a2a/default/pre_pws.js
content-length: 305
x-served-by: cache-mdw17377-MDW, cache-fra19180-FRA
last-modified: Mon, 11 Oct 2021 20:10:26 GMT
server: UploadServer
x-file-loc: primary0
x-timer: S1635410981.304015,VS0,VE0
etag: "bf661349cca51901bbf66e872a84e79a"
x-orig-url: /script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pre_pws.js?type=default
vary: Accept-Encoding
x-goog-hash: crc32c=iTGIWQ==, md5=v2YTScylGQG79m6HKoTnmg==
x-goog-generation: 1633455346037853
via: 1.1 varnish, 1.1 varnish
expires: Wed, 20 Oct 2021 14:15:42 GMT
cache-control: public, max-age=43200
x-goog-stored-content-length: 534
accept-ranges: bytes
content-type: text/javascript
x-cache-hits: 5, 3

GET
H2 200 pws.js Show response
fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/ 475 KB
140 KB 75ms
74ms Script
text/javascript 151.101.130.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 47a0e9dbf9e885b4760f180c2835444fc0958cc2328e6a1239f3d9ef8443abd6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
age: 9956
x-guploader-uploadid: ADPycdtG6SWPEhGBHfRoG70MTRB9mao0ack1is5x-3Yr0FSwTtYiT23V3LLjRC36GZJcLvOymf8opDoHdhercE3eh5FdZ0QiBA
x-cache: MISS, HIT
x-goog-storage-class: STANDARD
x-split-fraction: 100
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-restarts: 0
x-verify-21-url: /prod/sites/6/7/5/6758a527-c373-49a4-94e6-5a958edc9a2a/default/s/DE/desktop-pws.js
content-length: 142697
x-served-by: cache-mdw17361-MDW, cache-fra19180-FRA
x-verify-12-url: /prod/sites/6/7/5/6758a527-c373-49a4-94e6-5a958edc9a2a/default/s/DE/desktop-pws.js
last-modified: Mon, 11 Oct 2021 20:10:34 GMT
server: UploadServer
x-file-loc: primary0
x-timer: S1635410981.448327,VS0,VE68
etag: "d3893c239b9d5261b95297ee4a775736"
x-orig-url: /script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
vary: Accept-Encoding
x-goog-hash: crc32c=IAbYcw==, md5=04k8I5udUmG5UpfuSndXNg==
x-goog-generation: 1633983034747942
via: 1.1 varnish, 1.1 varnish
expires: Wed, 27 Oct 2021 19:03:39 GMT
cache-control: public, max-age=43200
x-goog-stored-content-length: 486712
accept-ranges: bytes
content-type: text/javascript
x-c-host: S
x-cache-hits: 0, 5

GET
H2 200 cropped-cropped-femme4-wide-logo.png
femme4.com/wp-content/uploads/2020/08/ 14 KB
14 KB 13ms
13ms Image
image/png 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2020/08/cropped-cropped-femme4-wide-logo.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d695786f3300c1fdf80b2d5f3d01aefb95f629999b2bdba76114e3df27eeee96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5527760
vary: Accept-Encoding
content-length: 13937
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 31 May 2021 18:33:22 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "60b52bf2-3671"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p5fIGSWs%2BoIpfjBN0YjC%2FqNAMSxswLHDhzwvBe5shsuGt1NUqMCNsVsCZLGx%2Bd%2FC5%2BShaQxXY1y7Ag5ffBKR%2FJgQOBXx0Gmoz5Q3jfRbEGqkInj7MaXBZVDife9XNC0Xiwmp3obxbj41"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a0d28697b-FRA

GET
H2 200 wp-emoji-release.min.js Show response
femme4.com/wp-includes/js/ 18 KB
5 KB 30ms
30ms Script
application/javascript 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4215086
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 26 Jul 2021 19:02:13 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60ff06b5-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CE%2F7s3dAP4oHSkhIc5reGl0abuBi9ACtj6fJvPtOY%2FyLaG8LG%2BdE1eR%2BAzqIwiNtSihy%2FQWXHHnaF1kqCZT1jFBtz%2Fp2aJMIXcpC3FXenZ7nkzeBBGl83845q%2FBcUnjJtioN%2BwtE1%2FMP"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a52e98a0d2a697b-FRA

GET
H2 200 offside.min.js Show response
femme4.com/wp-content/plugins/gp-premium/menu-plus/functions/js/ 6 KB
3 KB 15ms
15ms Script
application/javascript 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/plugins/gp-premium/menu-plus/functions/js/offside.min.js?ver=2.1.0-alpha.3

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ab6ba1e7e051b464b2a5855abc359ba0f4cde98edc2335e2648bbfe5a35cf38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3358322
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 19 Sep 2021 10:42:02 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"614713fa-1631"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H7wJbvQ7yijAPFARXzlzdeSz3%2BZKJkKmO2LoV7yYEO6%2B9TIMu28w4E80W5tmQP8DCEuZyySsIl5CagKOVGsjj9vpSQ%2Fn2mJV%2BZme7c3%2FlXk3pGwa4bMooWwyfhvaIDbdjX5LZ63u%2BqGt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a52e989cc8c697b-FRA

GET
H2 200 menu.min.js Show response
femme4.com/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 21ms
20ms Script
application/javascript 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.1.0

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

775a02c37772954d38fe41b802b94a0ee37dccb98a03827cdef3eddd2abc13d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 16182
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 26 Oct 2021 22:48:45 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"617885cd-1b1c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yv%2BOoiuXjmh4n9pKv2sgBi3Ri1fQ7cO9qPSf8VL7KyJU1RWdXANZH7yX44SImRd3gAzOq840A2bXb3pro65rNdhpFAF1%2BjCKzT8Tj6GBEc3Qa%2Fk5v9OGEpKiZYxoc%2BIqCT8ZIxXD0QBw"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a52e989ecc3697b-FRA

GET
H2 200 navigation-search.min.js Show response
femme4.com/wp-content/themes/generatepress/assets/js/ 2 KB
1 KB 12ms
12ms Script
application/javascript 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/themes/generatepress/assets/js/navigation-search.min.js?ver=3.1.0

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4d0c6a094ec876c2dbea780dac5655e44bc1ec2b0c9c492f8513581879c89c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 120434
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 26 Oct 2021 22:48:45 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"617885cd-858"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4W1qE6D0FFmsvGNCJk0Db6FWe2Zqom%2Flouwhu%2FwHbZsgfOhhHWCLfes0BWfLzhfwpjH6zkai1YoOQE4%2FtG05SIYK2v80wMal5WVfVPOWlc6Rx%2B4REZHsC0J%2BuF3MsY%2FpKpDK4JbQX6wn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a52e98a0d16697b-FRA

GET
H2 200 back-to-top.min.js Show response
femme4.com/wp-content/themes/generatepress/assets/js/ 763 B
698 B 13ms
11ms Script
application/javascript 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.1.0

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa6953b24e42640645ebc36a7bdead13b10abdddd28abec1d8d7904d329e6cd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 120434
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 26 Oct 2021 22:48:45 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"617885cd-2fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F02ZQzdDPxRAXEB9dmdXR53OFx4Iiy6wKmb%2FyPmBm3rDeXT%2FrM6cRpXahmKRgb%2F6W4Xgh1xc2UAEDxG6opsFX79c%2F%2BjOLabZMtyY97V%2FtXVEy2t9J9Xo05FpA3Qh9CJMzBwWInAP%2BBib"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a52e98a0d21697b-FRA

GET
H2 200 wp-embed.min.js Show response
femme4.com/wp-includes/js/ 1 KB
1 KB 14ms
13ms Script
application/javascript 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-includes/js/wp-embed.min.js?ver=5.8.1

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4215086
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 06 Jun 2021 11:47:44 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60bcb5e0-592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=id3PtBhiSvEIa1d8pIdqnixKouEOcuz7rAEuYu9pD%2BLreFZFL6vhtwhtq5zo51VI9Wc789P1kMCE67SEPai5v%2FShYVUhj2MItwAnHr88Wft%2BC679R53D1YVGeQSVtAYlbVMAMq1V7sGP"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a52e98a0d26697b-FRA

GET
H2 200 7Auwp_0qiz-afTLGLQ.woff2
fonts.gstatic.com/s/muli/v22/ 30 KB
31 KB 30ms
8ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/muli/v22/7Auwp_0qiz-afTLGLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli:300,300italic,regular,600,600italic,800,800italic,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://femme4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 02:58:13 GMT
x-content-type-options: nosniff
age: 539488
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31120
x-xss-protection: 0
last-modified: Wed, 15 Jul 2020 20:50:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 02:58:13 GMT

GET
H2 200 Supplements.jpg
femme4.com/wp-content/uploads/2021/10/ 48 KB
48 KB 13ms
13ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Supplements.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce8e5351d68c6a67d2a6806c949278f21148c3b988111d12922d40eba20655cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 16240
vary: Accept-Encoding
content-length: 48774
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 18 Oct 2021 14:46:26 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616d88c2-be86"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FHmvSc%2Fiju31f2d92%2Ferk2cBRT8v7dwdan5Ojnr0BGBJrbubB%2BdbN%2FY0Ba7g8zn%2FrkmBwraWGZ3EU5UmFqC1yi4IcCmcBi%2BdP%2BT8FkAMXCyyOcwEH%2BiMQ2g7p2zBvGE%2FL35bVAcMcY5w"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a1d4b697b-FRA

GET
H2 200 Types-Of-Cabbage.jpg
femme4.com/wp-content/uploads/2021/10/ 103 KB
103 KB 16ms
13ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Types-Of-Cabbage.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d56db5a9b7ec8f5eb6e1f959719e2a33c37fa9adcbad5634b86e2a25b57cbdfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 16239
vary: Accept-Encoding
content-length: 105222
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 18 Oct 2021 14:51:09 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616d89dd-19b06"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mc5MW1iJtProkOvFZWrxfvA9LRSrR%2FZRZI6jPPS0bsdXVhNahO36iB2AuBwawX8wGHhoXKfJqipLSha5HAHIobkjoU3KnY7f4Fk5WGxWgGdNYCQOKXkRxyjVg9r2YrTksreeEscicelr"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dba697b-FRA

GET
H2 200 f4adac497b863ad69ea15904029c6a8c
secure.gravatar.com/avatar/ 990 B
1 KB 29ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/f4adac497b863ad69ea15904029c6a8c?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc2f72d429e09f22a75be0181d5085859ea78465a38b4156fb7dac894bc0ade4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 28 Oct 2021 08:49:41 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="f4adac497b863ad69ea15904029c6a8c.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/f4adac497b863ad69ea15904029c6a8c?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Thu, 28 Oct 2021 08:54:41 GMT

GET
H2 200 Fall-Asleep-Quickly-768x768.jpg
femme4.com/wp-content/uploads/2021/10/ 45 KB
46 KB 69ms
65ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Fall-Asleep-Quickly-768x768.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

305775e3cbae80b303ccaf44cd5231807934a2a09d04e2c0a8c16ab83c2090ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 155585
vary: Accept-Encoding
content-length: 46220
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 18 Oct 2021 14:41:38 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616d87a2-b48c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AGo30Ardt13SbjkxSn5QSPZF68tgb%2B3gO9JjS7seV6QkMr0cACkmFW3RjP%2Fw5J%2FHFibcDIRQsc8%2F3QiwAhuqfZBZs5wjFBBX5z2BOqqIylXDUahoDi%2Fbb3KHZKNkwGpD8CG8ZE62ov80"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dbf697b-FRA

GET
H2 200 ce76f0a205df5e92bbd271be4d62f3b0
secure.gravatar.com/avatar/ 990 B
1 KB 29ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/ce76f0a205df5e92bbd271be4d62f3b0?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cd7fed18a4a3bf5287cf7318c717fe4cb80aedb0dce2c8101244fe4d14f3726e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 28 Oct 2021 08:49:41 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="ce76f0a205df5e92bbd271be4d62f3b0.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ce76f0a205df5e92bbd271be4d62f3b0?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Thu, 28 Oct 2021 08:54:41 GMT

GET
H2 200 Drinking-Coffee.jpg
femme4.com/wp-content/uploads/2021/10/ 76 KB
76 KB 31ms
28ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Drinking-Coffee.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e26931fb2ef420ec5257277f353574bef2f0639792068737ea5073e98500df38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 324140
vary: Accept-Encoding
content-length: 77572
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 18 Oct 2021 14:37:45 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616d86b9-12f04"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zNIU3UVeQGBh%2BmjZFrDB%2B7tFS5Rb%2FYXY2Hb9Um2xxQXUKIkHdKuFVCfD9nWkSf2CQ5QCAzTXbfSxB3JT9tr8zwNE1rrBRk0PKqDqmT%2FwL2z34aafY46B7rGzRaHve2eMTiVySE03TzdC"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dc3697b-FRA

GET
H2 200 Beauty-Canons.jpg
femme4.com/wp-content/uploads/2021/10/ 34 KB
34 KB 27ms
24ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Beauty-Canons.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0749ee01363cc8df5e94a0412fff86d23a48ff31c5fa444c97ad80811ece2fb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 35717
vary: Accept-Encoding
content-length: 34756
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 18 Oct 2021 14:34:12 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616d85e4-87c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FLVHj3k%2F%2F9XQfKEcDB46xR9H9zL2SGwXaPghcqtJICRD6E1RJzo2jEWQETMvwCXs3YKBoIDRiOWZEzjAxCV8tyBiMRuzoJkaHgl%2FlhHTWWPOrNAFr5ty60Q%2FQCKP2jFpugxv1meUm1%2F7"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dc5697b-FRA

GET
H2 200 5fe07f4e824a37b592515798eabb9975
secure.gravatar.com/avatar/ 990 B
1 KB 29ms
7ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5fe07f4e824a37b592515798eabb9975?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc2f72d429e09f22a75be0181d5085859ea78465a38b4156fb7dac894bc0ade4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 28 Oct 2021 08:49:41 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5fe07f4e824a37b592515798eabb9975.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5fe07f4e824a37b592515798eabb9975?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Thu, 28 Oct 2021 08:54:41 GMT

GET
H2 200 Grapes.jpg
femme4.com/wp-content/uploads/2021/10/ 134 KB
135 KB 57ms
54ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Grapes.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07d6604879e697ef74c6c3616d9e704f949497a427199b044aceb10e049a6993

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 490297
vary: Accept-Encoding
content-length: 137660
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 18 Oct 2021 14:23:51 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616d8377-219bc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WAfz%2B1ATLGXwny%2Bh7YUbS%2FK%2BL0M14bVKbH5wBaq%2BhVdXhpGS0fRgZIlwphMikR87dVpXCDA4nFZD3U67dmkiE8MIWSe0fTryiSqkGxDe3z88opVEVyy6GvASy3ehf20p1u3Ipk%2BcuP5n"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dc6697b-FRA

GET
H2 200 Chronic-Stress.jpg
femme4.com/wp-content/uploads/2021/10/ 29 KB
30 KB 63ms
60ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Chronic-Stress.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40df2187500d375805e50a748d5820bb4461962f246aeec9500bb1d4bed41931

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 577000
vary: Accept-Encoding
content-length: 30117
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 18 Oct 2021 14:17:54 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616d8212-75a5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2YpAnRfpyFiszJp8uXm5p1rWPjHjkkj6Etmtqc2e6mQRoC0N451xzjmoZQJzUPnkCnMnzuIRLXGVl7c1TJwPj5XL%2BQSIziLOq%2BTx%2FvfXolGhLpe9XemTktq4y%2B93hDs3n3zW0t2Zjew%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dc7697b-FRA

GET
H2 200 fbf3863867f87bded433f0ce7af120d1
secure.gravatar.com/avatar/ 990 B
1 KB 28ms
7ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/fbf3863867f87bded433f0ce7af120d1?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc2f72d429e09f22a75be0181d5085859ea78465a38b4156fb7dac894bc0ade4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 28 Oct 2021 08:49:41 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="fbf3863867f87bded433f0ce7af120d1.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/fbf3863867f87bded433f0ce7af120d1?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Thu, 28 Oct 2021 08:54:41 GMT

GET
H2 200 Arteries.jpg
femme4.com/wp-content/uploads/2021/10/ 63 KB
63 KB 41ms
39ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Arteries.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c821fb5da200f8cbf44f450c2f8a05b07f65ad5834aeff124b9058234f39146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 662403
vary: Accept-Encoding
content-length: 64393
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 18 Oct 2021 14:13:46 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616d811a-fb89"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9li73H54MiKRmoeuWEMm322%2BYgs3eM0ofxVeRISEtXT6CbqoZIvz%2F%2FcmYSGjE9koUO3%2FJDrTtViZO6hzixD8JK%2FjRL8hq08lfizSWV%2F%2BZRDNhxHjh7ni1WBV0UaSb79M6gKF521z%2Fiy%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dc9697b-FRA

GET
H2 200 62725d79a7f6043808f5d53ad24b62a1
secure.gravatar.com/avatar/ 990 B
1 KB 28ms
7ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/62725d79a7f6043808f5d53ad24b62a1?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cd7fed18a4a3bf5287cf7318c717fe4cb80aedb0dce2c8101244fe4d14f3726e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Thu, 28 Oct 2021 08:49:41 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="62725d79a7f6043808f5d53ad24b62a1.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/62725d79a7f6043808f5d53ad24b62a1?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Thu, 28 Oct 2021 08:54:41 GMT

GET
H2 200 stay-awake.jpg
femme4.com/wp-content/uploads/2021/10/ 29 KB
29 KB 40ms
38ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/stay-awake.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbf0802fe5882be9637727e0b98f9416e354cb71b94cbcfe7c63b37c835c0ebb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 770395
vary: Accept-Encoding
content-length: 29302
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 12 Oct 2021 10:48:13 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616567ed-7276"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2%2BNNoTrMXczVMcGGw%2BCCiM%2Br28NiVm9%2FVG1IqsGqGFy7FXKi3E2BMGplyvG7HSF1LDRVm8WQkpsURvUscaKAAd8BauoGUSlBQfYuBoAM%2F7eJ0P9fnvyZHjseeJMgFeGQv6kt1zg4gWLl"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dcc697b-FRA

GET
H2 200 Honey.jpg
femme4.com/wp-content/uploads/2021/10/ 98 KB
98 KB 42ms
40ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Honey.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55fdb026bafc5c05888471a5528d8420cebb8a8a6bd1a6b1ef65a387b92ce8cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 856794
vary: Accept-Encoding
content-length: 99886
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 12 Oct 2021 10:45:12 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "61656738-1862e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=olBVj0T7tKU20VRMPhmxvTHFaaDzyFqL4Po9MdeImzqKxnmk0HcaH9sREj%2F62NfdqrZBVhNa7k2YP5NIh6kPrYwRYiSPLbKjoqxKPQ%2FzzdLigKP6npWtHdI9hDzcORqcz1gWYCOodhjR"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dcf697b-FRA

GET
H2 200 Psychologist-768x908.jpg
femme4.com/wp-content/uploads/2021/10/ 51 KB
51 KB 50ms
49ms Image
image/jpeg 2606:4700:3032::ac43:9947
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Psychologist-768x908.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:9947 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0cfba76569008d0f6e9e617877f4aac8c94bd978835a0bc33890f9019a6627d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 943476
vary: Accept-Encoding
content-length: 51998
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 12 Oct 2021 10:41:40 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "61656664-cb1e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y7PtxYSVnxQmMfZxjWalF3llPqgen7M7%2FH1NEP%2B724Gqf1SzizFTfWp6LcbqbFUW5a9J2%2FXiq7TdPywXeMm%2BnKWNQnfVxUW14Ch%2BBO76lie8Huz2yyfys7iXT%2BI94YIaxnu7absMrrnj"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a52e98a5dd0697b-FRA

GET
H2 200 liveView.php Show response
live.primis.tech/live/ 43 KB
12 KB 58ms
18ms Script
text/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 90305248994bccbf2b5129ccd0ee7514064e5b09139e9cb083d161ebb64e0179

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

GET
H2 200 pubads_impl_2021102501.js Show response
securepubads.g.doubleclick.net/gpt/ 356 KB
120 KB 22ms
22ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcd346804a786db16b40af2672924a5b8787623f71d648a017da7e236e1b19b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 122594
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 08:35:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 28 Oct 2021 08:49:41 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 139 B
124 B 30ms
16ms XHR
application/json 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

012e92c03081a92012f30ccbd917d07162c4b888e4edb883e42297e3f7133337

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 99
x-xss-protection: 0
expires: Thu, 28 Oct 2021 08:49:41 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-149428601-5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 26 Oct 2021 23:24:02 GMT
server: Golfe2
age: 2915
date: Thu, 28 Oct 2021 08:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19747
expires: Thu, 28 Oct 2021 10:01:06 GMT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame A04C 5 KB
2 KB 20ms
19ms Script
text/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1635410981&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 0df506acaecea2dc23579d5d5c4ce0ef406203bef6094e9d92deca13d49ba9d1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:40 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
202 B 14ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=503897133&t=pageview&_s=1&dl=https%3A%2F%2Ffemme4.com%2F&ul=en-us&de=UTF-8&dt=Femme4%20-%20For%20Her&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=2051997551&gjid=487124978&cid=1451520711.1635410982&tid=UA-149428601-5&_gid=1581244885.1635410982&_r=1&gtm=2ouar0&z=835045299

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://femme4.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
970 B 40ms
13ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 20
content-type: application/javascript
x-amz-request-id: txa9f7a43a20cf4c4c9390f-00616d2a11
x-amz-id-2: txa9f7a43a20cf4c4c9390f-00616d2a11
last-modified: Mon, 18 Oct 2021 08:01:51 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=deQ68FZ7uEBzXEPwpeVWWUUtqdBrYCrcWhSPvWY5tcs9PjTVQCs56hdN4EHCMWrQu2KOX1d9Lz4jZ3xCQEjH4rFM0XYCcEXzTwGLXcyIYpa1FvG3C61fK85r9VhSnDPKuFkZbiW4aVNgfmFC"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: 1634544111259554
cache-control: public, max-age=1800
cf-ray: 6a52e98bb9911f2d-FRA
expires: Thu, 28 Oct 2021 09:19:41 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 14 KB
7 KB 216ms
194ms XHR
application/json 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

780c658cbcb9495edbc0393977a8e8468c4f56ed783aae96170c8c6ef03c397d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 28 Oct 2021 08:49:41 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 57249355-c1da-448f-bbbb-5c4c14bfcac5
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://femme4.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
374 B 371ms
182ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Thu, 28 Oct 2021 08:49:41 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 91
vary: origin, Accept-Encoding

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 65 B
293 B 125ms
97ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=aYHEBY2cyr64kvaKjGFx_2
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 8eb0eb47b96274d6e3aa2c9ea7bcd221ba3529865e0361f171d133f0ff83824f

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
110 B 62ms
35ms XHR
text/plain 18.193.159.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.193.159.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-159-101.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Thu, 28 Oct 2021 08:49:41 GMT
access-control-allow-credentials: true
vary: Origin

GET
H2 200 arj Show response
pubwise-d.openx.net/w/1.0/ 172 B
556 B 54ms
23ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pubwise-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Ffemme4.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=d4d15322-5322-4fcc-b35d-e2316698cab0&nocache=1635410981708&pubcid=5f46df80-64d4-4b25-9536-60b6119c0fc3&schain=1.0%2C1!pubwise.io%2C6758a5%2C1%2C%2C%2C&aus=728x90%2C320x50%2C300x50%2C320x100%2C1x1%2C970x90&divids=femm_adhesive&aucs=&auid=545648436
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 2f250b0aa53baaec5ebd2d5ceea4d7026a239eecb7271e5b65c5d258b48f20c1

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: OXGW/16.217.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://femme4.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 163
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 0
318 B 76ms
16ms XHR
application/json 185.86.137.113
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.113 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://femme4.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
content-length: 0

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 0
318 B 77ms
17ms XHR
application/json 185.86.137.113
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.113 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:40 GMT
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://femme4.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
content-length: 0

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 14 KB
8 KB 142ms
97ms XHR
application/json 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.15.0
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: 0fc781094fd355a1c6b5c438f6d8fcb8f16c811b5034512307c2e0e96e1353d5

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 28 Oct 2021 08:49:41 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://femme4.com
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
184 B 130ms
109ms XHR
text/html 34.107.161.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://femme4.com
x-cloud-trace-context: 925892fae2d48b2e7c6a6fedd6a9390b
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

GET
H2 200 iab_consent_sdk.v1.0.js Show response
live.primis.tech/content/ClientDetections/ Frame A04C 19 KB
6 KB 16ms
13ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1635410981&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 15:01:36 GMT
server: nginx
etag: W/"5e441350-4be0"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Fri, 28 Oct 2022 08:49:41 GMT

GET
H2 200 DetectGDPR2.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame A04C 9 KB
3 KB 15ms
14ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR2.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1635410981&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 154212eb976f7df7c79f5844fcb356740bcb6c51edacb2e8515108e2d7effa67

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:40 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:48 GMT
server: nginx
etag: W/"6024fccc-228f"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Fri, 28 Oct 2022 08:49:40 GMT

GET
H2 200 DetectGDPR.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame A04C 8 KB
3 KB 13ms
12ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1635410981&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 5bb08412d18881e3fc69fdb44226bfc6f66a77d45dfff3f10b98a100c09bc970

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:48 GMT
server: nginx
etag: W/"6024fccc-1ef8"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Fri, 28 Oct 2022 08:49:41 GMT

GET
H2 200 hls.0.12.4_2.min.js Show response
live.primis.tech/content/video/hls/ Frame A04C 256 KB
86 KB 18ms
17ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1635410981&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 13ab06913444b6e3b4139e5487813073f11e082878ae8a5bf5213fdc6f95f5e0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
last-modified: Thu, 13 Aug 2020 08:36:05 GMT
server: nginx
etag: W/"5f34fb75-3ff27"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Fri, 28 Oct 2022 08:49:41 GMT

GET
H2 200 prebidVid.5.18.0_1.min.js Show response
live.primis.tech/content/prebid/ Frame A04C 482 KB
175 KB 28ms
27ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1635410981&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: c518cbe4996d331e755dacf65728d3421e6358de619f7bf051295a22d0f8f936

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
last-modified: Thu, 21 Oct 2021 12:43:40 GMT
server: nginx
etag: W/"6171607c-789a7"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Fri, 28 Oct 2022 08:49:41 GMT

GET
H2 200 liveVideo.php Show response
live.primis.tech/live/ Frame A04C 551 KB
151 KB 38ms
37ms Script
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1635410981&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 49099c42a53100480e58551c9fe29e0affa409b41fb0a0ab160a58ecadf98205

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
content-type: text/html; charset=UTF-8

GET
H2 200 adagio.js Show response
script.4dex.io/ 71 KB
22 KB 30ms
17ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 071ae33974e54b0b7586b5ecc94a40ab118f7df9a387f351231095b51aafe93e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 866806
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: tx04b2dbcdab474249bd4b5-00616d2a11
x-amz-id-2: tx04b2dbcdab474249bd4b5-00616d2a11
last-modified: Mon, 18 Oct 2021 08:01:50 GMT
server: cloudflare
etag: W/"cae476c264f28e37aca638d685ba55b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zVcc8VyGlmNz09T67cRrP7t7Da76%2F%2FlLnIxvEpBv0Nw9WVaIsy7JxB7HYrbT26fuhW9yu8E6m5xJzDY6sjJtqbl1Bt6ybp6r%2BCifd9gfR52CkTRIP7ghFLf3wdBVaVD%2Fdy1KQ88uarnc%2Bckv"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1634544110326910
cf-ray: 6a52e98beca96993-FRA
access-control-allow-headers: Authorization

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
140 B 139ms
116ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-ml1l
alt-svc: clear

GET
H2 200 primisslate.css
live.primis.tech/content/video/css/ 17 KB
5 KB 13ms
13ms Stylesheet
text/css 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/css/primisslate.css
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f7cd55655bafca4db9b67255125ed52cd91d21b1727e9f28f71219aa1341de5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
last-modified: Tue, 18 Aug 2020 10:07:25 GMT
server: nginx
etag: W/"5f3ba85d-45c8"
content-type: text/css

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame A04C 133 KB
36 KB 35ms
9ms Script
application/javascript 143.204.95.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-188.fra50.r.cloudfront.net
Software: Server /
Resource Hash: 975b62423e82390a1b54f47625f46f5b4451a8ea69945b2e85008a194bb55edd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: nY_PcrO6M1v8rxrnAfvFh4iOgrD_tFp3
content-encoding: gzip
etag: 3900a2c2d757386fb762bfd86288f882
age: 307
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 0655ENTY5F4QWC2XSFYC
date: Thu, 28 Oct 2021 08:44:34 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: pGckdhbeNA0ekFZYCY0tZAprzc52uVYDhyqron0076ap9xc19UQbhA==

GET
H2 200 css
fonts.googleapis.com/ Frame 6029 2 KB
623 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 07:57:57 GMT
server: ESF
date: Thu, 28 Oct 2021 08:49:41 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Thu, 28 Oct 2021 08:49:41 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
623 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 07:50:18 GMT
server: ESF
date: Thu, 28 Oct 2021 08:49:41 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Thu, 28 Oct 2021 08:49:41 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 55F8 14 KB
5 KB 31ms
7ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D617a6425980ce%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=101408
expires: Fri, 29 Oct 2021 12:59:49 GMT
date: Thu, 28 Oct 2021 08:49:41 GMT
vary: Accept-Encoding

GET
H2

200

liveCS.php Show response
live.primis.tech/live/ Frame 9D26
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D617a6425980ce%26pixel%3D%26advId%3D94%26advUuid%3D%24...
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D617a6425980ce%26pixel%3D%26advId%3D94%26advUuid%3D%24...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=94&advUuid=fde946cd-37cb-11ec-894c-16877d160306

0
223 B

16ms
16ms

Document
text/html

185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=94&advUuid=fde946cd-37cb-11ec-894c-16877d160306
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

server: nginx
date: Thu, 28 Oct 2021 08:49:41 GMT
content-type: text/html; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
pragma: no-cache
age: 0
content-encoding: gzip

Redirect headers

Server: nginx
Date: Thu, 28 Oct 2021 08:49:41 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=94&advUuid=fde946cd-37cb-11ec-894c-16877d160306
X-fe: 83
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0

GET
H2

200

liveCS.php Show response
live.primis.tech/live/ Frame B54C
Redirect Chain

https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D617a6425980ce%26pixel%3D%26advId%3D98%26advU...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=98&advUuid=7b4f0669-8115-4c21-8b85-3e7d99f37f2b

0
223 B

16ms
15ms

Document
text/html

185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=98&advUuid=7b4f0669-8115-4c21-8b85-3e7d99f37f2b
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

server: nginx
date: Thu, 28 Oct 2021 08:49:41 GMT
content-type: text/html; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
pragma: no-cache
age: 0
content-encoding: gzip

Redirect headers

vary: Accept, Accept-Encoding
server: OXGW/16.217.1
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=98&advUuid=7b4f0669-8115-4c21-8b85-3e7d99f37f2b
date: Thu, 28 Oct 2021 08:49:41 GMT
content-type: text/html
content-length: 0
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame 128F 2 KB
1 KB 238ms
21ms Document
text/html 2a0c:5c81:5095:0:225:90ff:fefa:245d
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5095:0:225:90ff:fefa:245d , United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: d08213d6bec2ffbc813ca7522353c65a97241a26d89bc7964ae1805ca65c9e09

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Server: VertaMedia 1.0
Date: Thu, 28 Oct 2021 08:49:41 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 823
Access-Control-Allow-Origin: https://femme4.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Encoding: gzip

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame A04C 18 KB
4 KB 35ms
35ms XHR
application/json 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNvUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMDp2MCUlRaZcZGViXmYjYzRyMTY5MDVyYwE5Mwp3NDpmOTMyMxZ2nWQ2MTp2YwVxNzE0YwQjMmx4OTYmMTMlLz1jNCZ2nWRsY29hqGVhqF9cZD0kOTE1MwYlJaZcZF9wo250ZW50X2Ryp2M9VGucplgXZWVeK2yhK0ucp3RipaxeJTI4MTAyMxYlNSfgKmEjJTJGMmEyMwxzqzyxX2NioaRyoaRsqGy0oGU9VGucplgXZWVeK2yhK0ucp3RipaxeJTI4MTAyMxYlNSfgKmEjJTJGMmEyMwxzqzyxX2NioaRyoaRsZHVlYXRco249NTtzZGVvqWqJozZipz1uqGyiow1BQyQeJTJGK01uZ25cqGVCnWRBZGbeJTJGKmIeJTJGKmAhNCZ4PTY5MCZ5PTM5MCZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJaJcPTZDNwx3NwY1NTM3NDYkNmQ3MmqDNmM2QwMkN0I1NDMjN0Q3QwY0MmImMDMlMmElRDMkMmAlRDMlMmt1RwMkMmE3RDqCNmMmMTM1MmImNTMjMmAmMTMkN0Q3QwQmMmUmNmqEN0I1MmY0NTpmNTZCNUE1NmVBNmA2MwZENTY2QwU4MmI1QTZDNwI1NmMkNxM0RTQmMmU2QTYlMmImMDNEN0Q3QwYlNwM2ODplNxY2RDY1N0Q3QwpkNwQ2NTpmNxI3NDZGNmA3RDqCNxY3NmY5NxU2NDZGNmp3MmqEN0I1ODM2MmxmMDqEN0I1OTMmMmxmMDqEN0I2NwMkN0Q3QwplNTE1NTRBNTU0OTQmMmt2NmU0NTp0NwZFNwI2RDZDMmA1QTU1NEE3MDVBNDU0NwZCNwE2OTQkNmY0OTQ0NDx2NmRDNmx0MTp3NEM2QTUkM0Q3RDqCNEMmMTMjMmpmNDM5N0RGRUZFJzymQXBjPTAzZ2ViTGF0nT01MC4kMTt4Jzqyo0kiozp9OC42ODQmJaVmZXJJpEFxZHI9OTEhMTx5LwEkOC43MvZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGOTUhMC40NwM4LwU0K1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkN2E2NDI1OTtjY2UzY2J1p3Rypw0kNwM1NDEjOTtkODxjJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: df6437f240e4567bc9c1205f3795538d05ebecdd358719df254d525002a54a40

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 4328

GET
H2 200 chunklist_480.m3u8 Show response
video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/ 443 B
698 B 58ms
12ms XHR
application/vnd.apple.mpegurl 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/chunklist_480.m3u8
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: c7464b0a9331f53f8f055809809154e85020708b5546cd318aff9fa2dd7ff2d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
last-modified: Mon, 25 Oct 2021 13:50:43 GMT
server: Tengine
etag: "6176b633-1bb"
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
expires: Thu, 11 Nov 2021 08:49:41 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 443
x-proxy-cache: HIT, HIT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 19ms
18ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTUjJaNypaZypyRcoWU9MTYmNTQkMDx4MSZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA1NDY0JaN0YT0jJat9NwxjJax9MmxjJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9qW5xZWZcozVxX2ZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow1BQyQyMwAyMxYyMwBNYWqhnXRyQzyxQWRdJTIjJTJGJTIjMvUlMCUlRvUlMDAhNCZcp0FjpD0jJaJcPTZDNwx3NwY1NTM3NDYkNmQ3MmqDNmM2QwMkN0I1NDMjN0Q3QwY0MmImMDMlMmElRDMkMmAlRDMlMmt1RwMkMmE3RDqCNmMmMTM1MmImNTMjMmAmMTMkN0Q3QwQmMmUmNmqEN0I1MmY0NTpmNTZCNUE1NmVBNmA2MwZENTY2QwU4MmI1QTZDNwI1NmMkNxM0RTQmMmU2QTYlMmImMDNEN0Q3QwYlNwM2ODplNxY2RDY1N0Q3QwpkNwQ2NTpmNxI3NDZGNmA3RDqCNxY3NmY5NxU2NDZGNmp3MmqEN0I1ODM2MmxmMDqEN0I1OTMmMmxmMDqEN0I2NwMkN0Q3QwplNTE1NTRBNTU0OTQmMmt2NmU0NTp0NwZFNwI2RDZDMmA1QTU1NEE3MDVBNDU0NwZCNwE2OTQkNmY0OTQ0NDx2NmRDNmx0MTp3NEM2QTUkM0Q3RDqCNEMmMTMjMmpmNDM5N0RGRUZFJzRcYWyxPSZ1p2VlSXBBZGRlPTxkLwE5OS4kMTthNmIzqXNypyVBPU1irzyfoGEyMxY1LwAyMwAyMwuXnW5xo3qmJTIjTyQyMwAkMC4jJTNCJTIjV2yhNwQyM0IyMwB4NwQyMwxyMwBBpHBfZVqyYxgcqCUlRwUmNl4mNvUlMCUlOEgIVE1MJTJDJTIjoGyeZSUlMEqyY2giJTI5JTIjQ2ulo21yJTJGOTUhMC40NwM4LwU0JTIjU2FzYXJcJTJGNTM3LwM2JzNmqXVcZD02MTquNwQlNTx4MGNyJzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2MmU0MTA5ODE4ODEzqWyxPVNyn2yhZG9TUGkurWVlNwE3YTY0MwVvNwA2NSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame A04C 43 B
220 B 162ms
7ms Image
image/gif 18.185.142.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=sekindo&user_id=617a6425980ce&custom_data=617a6425980ce;live.primis.tech&gdpr=1&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.142.87 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-142-87.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame A04C
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D617a6425980ce%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D
https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=93&advUuid=3e4fb18e-83ed-412f-88bb-1a628bf00741

0
223 B

16ms
16ms

Image
text/html

185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=93&advUuid=3e4fb18e-83ed-412f-88bb-1a628bf00741
Protocol: H2
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=93&advUuid=3e4fb18e-83ed-412f-88bb-1a628bf00741
date: Thu, 28 Oct 2021 08:49:41 GMT
server: _
content-length: 0

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame A04C
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=192962&cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D617a6425980ce%26pixel%3D%26advId%3D99%26advUuid%3D
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D617a6425980ce%26pixel%3D%26advId%3D99%26advUuid%3D&s=192962&C=1
https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=99&advUuid=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB

0
223 B

16ms
16ms

Image
text/html

185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=99&advUuid=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB
Protocol: H2
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=99&advUuid=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 334
Expires: Thu, 28 Oct 2021 08:49:42 GMT

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame A04C
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D617a6425980ce%26pixel%3D%26advId%3D105%26advUuid%3D%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Flive.primis.tech%252Flive%252FliveCS.php%253Fsource%253Dexternal%2526csuuid%253D617a6425980ce%2526pixel%253D%2526advId%253D105%2526ad...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=105&advUuid=298353389270665838

0
223 B

19ms
18ms

Image
text/html

185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=105&advUuid=298353389270665838
Protocol: H2
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f1c94212-6f15-46b3-8ed3-14d66fac8ace
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=617a6425980ce&pixel=&advId=105&advUuid=298353389270665838
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 vid6176b5d6a4b40398963132.jpg
video.primis.tech/uploads/cn6/video/users/converted/30760/video_60bde16905eb1927747393/ 7 KB
7 KB 44ms
12ms Image
image/jpeg 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn6/video/users/converted/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.jpg?cbuster=1635169834

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

2bbd479b8ff77bdf475e38bc844d62f6e8e429a49fd14cc73ffb677af3a26e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
last-modified: Mon, 25 Oct 2021 13:49:54 GMT
server: Tengine
etag: "6176b602-1cc4"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 08 Nov 2021 14:30:12 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 7364
x-proxy-cache: HIT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame A04C 42 KB
6 KB 40ms
40ms XHR
application/json 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNvUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMDp2MCUlRaZcZGViXmYjYzRyMTY5MDVyYwE5Mwp3NDpmOTMyMxZ2nWQ2MTp2YwVxNzE0YwQjMmx4OTYmMTMlLz1jNCZ2nWRsY29hqGVhqF9cZD0kOTE1MwYlJaZcZF9wo250ZW50X2Ryp2M9VGucplgXZWVeK2yhK0ucp3RipaxeJTI4MTAyMxYlNSfgKmEjJTJGMmEyMwxzqzyxX2NioaRyoaRsqGy0oGU9VGucplgXZWVeK2yhK0ucp3RipaxeJTI4MTAyMxYlNSfgKmEjJTJGMmEyMwxzqzyxX2NioaRyoaRsZHVlYXRco249NTtzZGVvqWqJozZipz1uqGyiow1BQyQeJTJGK01uZ25cqGVCnWRBZGbeJTJGKmIeJTJGKmAhNCZ4PTU3MlZ5PTMlMvZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJaJcPTZDNwx3NwY1NTM3NDYkNmQ3MmqDNmM2QwMkN0I1NDMjN0Q3QwY0MmImMDMlMmElRDMkMmAlRDMlMmt1RwMkMmE3RDqCNmMmMTM1MmImNTMjMmAmMTMkN0Q3QwQmMmUmNmqEN0I1MmY0NTpmNTZCNUE1NmVBNmA2MwZENTY2QwU4MmI1QTZDNwI1NmMkNxM0RTQmMmU2QTYlMmImMDNEN0Q3QwYlNwM2ODplNxY2RDY1N0Q3QwpkNwQ2NTpmNxI3NDZGNmA3RDqCNxY3NmY5NxU2NDZGNmp3MmqEN0I1ODM2MmxmMDqEN0I1OTMmMmxmMDqEN0I2NwMkN0Q3QwplNTE1NTRBNTU0OTQmMmt2NmU0NTp0NwZFNwI2RDZDMmA1QTU1NEE3MDVBNDU0NwZCNwE2OTQkNmY0OTQ0NDx2NmRDNmx0MTp3NEM2QTUkM0Q3RDqCNEMmMTMjMmpmNDM5N0RGRUZFJzymQXBjPTAzZ2ViTGF0nT01MC4kMTt4Jzqyo0kiozp9OC42ODQmJaVmZXJJpEFxZHI9OTEhMTx5LwEkOC43MvZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGOTUhMC40NwM4LwU0K1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkN2E2NDI1OTtjY2UzY2J1p3Rypw0kNwM1NDEjOTtkOTE4JzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 7bc3d3638e64b4ebefd40cc1972d7c742873803b42de269892aebb9460176335

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 6162

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame A04C 42 KB
6 KB 41ms
41ms XHR
application/json 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNvUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMDp2MCUlRaZcZGViXmYjYzRyMTY5MDVyYwE5Mwp3NDpmOTMyMxZ2nWQ2MTp2YwVxNzE0YwQjMmx4OTYmMTMlLz1jNCZ2nWRsY29hqGVhqF9cZD0kOTE1MwYlJaZcZF9wo250ZW50X2Ryp2M9VGucplgXZWVeK2yhK0ucp3RipaxeJTI4MTAyMxYlNSfgKmEjJTJGMmEyMwxzqzyxX2NioaRyoaRsqGy0oGU9VGucplgXZWVeK2yhK0ucp3RipaxeJTI4MTAyMxYlNSfgKmEjJTJGMmEyMwxzqzyxX2NioaRyoaRsZHVlYXRco249NTtzZGVvqWqJozZipz1uqGyiow1BQyQeJTJGK01uZ25cqGVCnWRBZGbeJTJGKmIeJTJGKmAhNCZ4PTQjMCZ5PTIlNSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJaJcPTZDNwx3NwY1NTM3NDYkNmQ3MmqDNmM2QwMkN0I1NDMjN0Q3QwY0MmImMDMlMmElRDMkMmAlRDMlMmt1RwMkMmE3RDqCNmMmMTM1MmImNTMjMmAmMTMkN0Q3QwQmMmUmNmqEN0I1MmY0NTpmNTZCNUE1NmVBNmA2MwZENTY2QwU4MmI1QTZDNwI1NmMkNxM0RTQmMmU2QTYlMmImMDNEN0Q3QwYlNwM2ODplNxY2RDY1N0Q3QwpkNwQ2NTpmNxI3NDZGNmA3RDqCNxY3NmY5NxU2NDZGNmp3MmqEN0I1ODM2MmxmMDqEN0I1OTMmMmxmMDqEN0I2NwMkN0Q3QwplNTE1NTRBNTU0OTQmMmt2NmU0NTp0NwZFNwI2RDZDMmA1QTU1NEE3MDVBNDU0NwZCNwE2OTQkNmY0OTQ0NDx2NmRDNmx0MTp3NEM2QTUkM0Q3RDqCNEMmMTMjMmpmNDM5N0RGRUZFJzymQXBjPTAzZ2ViTGF0nT01MC4kMTt4Jzqyo0kiozp9OC42ODQmJaVmZXJJpEFxZHI9OTEhMTx5LwEkOC43MvZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGOTUhMC40NwM4LwU0K1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkN2E2NDI1OTtjY2UzY2J1p3Rypw0kNwM1NDEjOTtkOTE5JzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: c6c7078994e45b1a52b131f8450df32e848f11185d0fa179fe00a70ed8cbe136

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 6161

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame A04C 18 KB
4 KB 30ms
29ms XHR
application/json 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhNvUlRaZcZGViJTJGqXNypaMyMxZwo252ZXJ0ZWQyMxYmMDp2MCUlRaZcZGViXmYjYzRyMTY5MDVyYwE5Mwp3NDpmOTMyMxZ2nWQ2MTp2YwVxNzE0YwQjMmx4OTYmMTMlLz1jNCZ2nWRsY29hqGVhqF9cZD0kOTE1MwYlJaZcZF9wo250ZW50X2Ryp2M9VGucplgXZWVeK2yhK0ucp3RipaxeJTI4MTAyMxYlNSfgKmEjJTJGMmEyMwxzqzyxX2NioaRyoaRsqGy0oGU9VGucplgXZWVeK2yhK0ucp3RipaxeJTI4MTAyMxYlNSfgKmEjJTJGMmEyMwxzqzyxX2NioaRyoaRsZHVlYXRco249NTtzZGVvqWqJozZipz1uqGyiow1BQyQeJTJGK01uZ25cqGVCnWRBZGbeJTJGKmIeJTJGKmAhNCZ4PTU3MlZ5PTMlMvZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJaJcPTZDNwx3NwY1NTM3NDYkNmQ3MmqDNmM2QwMkN0I1NDMjN0Q3QwY0MmImMDMlMmElRDMkMmAlRDMlMmt1RwMkMmE3RDqCNmMmMTM1MmImNTMjMmAmMTMkN0Q3QwQmMmUmNmqEN0I1MmY0NTpmNTZCNUE1NmVBNmA2MwZENTY2QwU4MmI1QTZDNwI1NmMkNxM0RTQmMmU2QTYlMmImMDNEN0Q3QwYlNwM2ODplNxY2RDY1N0Q3QwpkNwQ2NTpmNxI3NDZGNmA3RDqCNxY3NmY5NxU2NDZGNmp3MmqEN0I1ODM2MmxmMDqEN0I1OTMmMmxmMDqEN0I2NwMkN0Q3QwplNTE1NTRBNTU0OTQmMmt2NmU0NTp0NwZFNwI2RDZDMmA1QTU1NEE3MDVBNDU0NwZCNwE2OTQkNmY0OTQ0NDx2NmRDNmx0MTp3NEM2QTUkM0Q3RDqCNEMmMTMjMmpmNDM5N0RGRUZFJzymQXBjPTAzZ2ViTGF0nT01MC4kMTt4Jzqyo0kiozp9OC42ODQmJaVmZXJJpEFxZHI9OTEhMTx5LwEkOC43MvZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGOTUhMC40NwM4LwU0K1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkN2E2NDI1OTtjY2UzY2J1p3Rypw0kNwM1NDEjOTtkOTIkJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D32385F31317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B7251554A55494338675457466E626D6C305A554A705A45466B61694176494449674C7941774C6A513D7D7B4C31303734397DFEFE&userIpAddr=91.199.118.72&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F95.0.4638.54+Safari%2F537.36&debugInformation=ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=617a6425980ce&debugInfo=15250011_ABT+%2F+MagniteBidAdj+%2F+2+%2F+0.4&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 0853c76357eff23ca13b7e29aa017fa883628f3b64b3c4b27fa7e07df1eaa490

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 4325

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://femme4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:27:37 GMT
x-content-type-options: nosniff
age: 228124
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 25 Oct 2022 17:27:37 GMT

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
57 B 111ms
110ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-mwsp
alt-svc: clear

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 6029 15 KB
15 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://femme4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 17:27:37 GMT
x-content-type-options: nosniff
age: 228125
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 25 Oct 2022 17:27:37 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 375ms
319ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 374ms
318ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 vid6176b5d6a4b40398963132_thumb.jpg
video.primis.tech/uploads/cn6/video/users/converted/30760/video_60bde16905eb1927747393/ 959 B
1 KB 15ms
14ms Image
image/jpeg 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn6/video/users/converted/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132_thumb.jpg?cbuster=1635169834

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

219a5efdc9e13b95cc1216eeadd6e35de690beaa836aaf475bd135ba73529c7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Mon, 25 Oct 2021 13:49:55 GMT
server: Tengine
etag: "6176b603-3bf"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 08 Nov 2021 14:30:17 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 959
x-proxy-cache: HIT

GET
H2 200 vid61275a46b7543193865728_thumb.jpg
video.primis.tech/uploads/cn21/video/users/converted/24271/video1511884110/ 5 KB
5 KB 21ms
20ms Image
image/jpeg 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn21/video/users/converted/24271/video1511884110/vid61275a46b7543193865728_thumb.jpg?cbuster=1629968971

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

adb05a9610d01ba9f0d2a739f8580e44c0047c014d372bde1e6c9d5807a8dcf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Thu, 26 Aug 2021 09:11:52 GMT
server: Tengine
etag: "61275ad8-1228"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Tue, 09 Nov 2021 20:25:59 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 4648
x-proxy-cache: HIT

GET
H2 200 vid617594de9bfe1451115537_thumb.jpg
video.primis.tech/uploads/cn5/video/users/converted/24271/video1511884217/ 2 KB
2 KB 23ms
22ms Image
image/jpeg 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn5/video/users/converted/24271/video1511884217/vid617594de9bfe1451115537_thumb.jpg?cbuster=1635095778

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

60c3827d56acfb543efe6dd7850c7823849c57af31bac15dac2dd8f4cafd13af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Sun, 24 Oct 2021 17:17:40 GMT
server: Tengine
etag: "61759534-81a"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 07 Nov 2021 18:42:26 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 2074
x-proxy-cache: HIT

GET
H2 200 vid6179c27995d79588467763_thumb.jpg
video.primis.tech/uploads/cn9/video/users/converted/24271/video1511884217/ 2 KB
3 KB 24ms
23ms Image
image/jpeg 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn9/video/users/converted/24271/video1511884217/vid6179c27995d79588467763_thumb.jpg?cbuster=1635369596

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

c3ba573779b178c7303289123840cbb6599b00df06556de6eca686bb07b2f6f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Wed, 27 Oct 2021 21:20:59 GMT
server: Tengine
etag: "6179c2bb-96e"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Wed, 10 Nov 2021 21:57:21 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 2414
x-proxy-cache: HIT

GET
H2 200 vid6179c28878235416029080_thumb.jpg
video.primis.tech/uploads/cn9/video/users/converted/24271/video1511884217/ 2 KB
2 KB 26ms
25ms Image
image/jpeg 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn9/video/users/converted/24271/video1511884217/vid6179c28878235416029080_thumb.jpg?cbuster=1635369612

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

9e62091e9fdb9fcf723989346c5a864efd3b368225ac36f4adf9e4cbdaf31695

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Wed, 27 Oct 2021 21:21:13 GMT
server: Tengine
etag: "6179c2c9-69f"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Wed, 10 Nov 2021 21:57:14 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 1695
x-proxy-cache: HIT

GET
H2 200 w_480_00000.ts Show response
video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/ 314 KB
315 KB 27ms
27ms XHR
video/mp2t 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/w_480_00000.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 3856064e1fa02ff4c2e1776f137eef1ec0023e0aad24d0359b5287b71c4d3602

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Mon, 25 Oct 2021 13:50:39 GMT
server: Tengine
etag: "6176b62f-4e9fc"
content-type: video/mp2t
access-control-allow-origin: *
expires: Thu, 11 Nov 2021 08:49:42 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 322044
x-proxy-cache: HIT, HIT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame A04C 6 KB
3 KB 25ms
9ms XHR
application/javascript 143.204.95.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-188.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: c91ZTIbLZrDqT0mloV_AD7.LNsTlhW69
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 17110
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 07 Oct 2021 01:02:33 GMT
server: AmazonS3
date: Thu, 28 Oct 2021 04:04:33 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be5.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: TtP8VlpAimPMO9LeA6XaDBpBIhUObCTJsaLFZ8yxIKEA8T4SfacvYg==

GET
H2 200 vid6176b5d6a4b40398963132.jpg
video.primis.tech/uploads/cn6/video/users/converted/30760/video_60bde16905eb1927747393/ 7 KB
7 KB 14ms
12ms Image
image/jpeg 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn6/video/users/converted/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.jpg?cbuster=1635169834

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

2bbd479b8ff77bdf475e38bc844d62f6e8e429a49fd14cc73ffb677af3a26e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Mon, 25 Oct 2021 13:49:54 GMT
server: Tengine
etag: "6176b602-1cc4"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 08 Nov 2021 14:30:12 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 7364
x-proxy-cache: HIT

GET
BLOB 200
OK 33b11596-6706-4f60-a433-482b116b7d0b
https://femme4.com/ 65 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://femme4.com/33b11596-6706-4f60-a433-482b116b7d0b
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2dffba8a31eb663c59a5494783cbf197c182104edc58f0c0a17b7992429d7af

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Length: 66258
Content-Type: text/javascript

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 55F8 0
42 B 72ms
17ms Script
text/plain 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=8641115&p=159196&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=1&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D617a6425980ce%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-length: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 26 KB
15 KB 397ms
397ms XHR
application/json 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 3af102d5b5940665d8b3e17cab92edd82e46240896a4fe05aa48727e516beda3

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 221
content-length: 15405

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
78 B 111ms
111ms XHR
text/html 34.107.161.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://femme4.com
x-cloud-trace-context: cbb50e31aa4d35af719a545066f30ccb
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
149 B 99ms
98ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=aYHEBY2cyr64kvaKjGFx_2
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 72634a53e71861216b1954ddeb15d33ac8fa0a6b35ff7b0a6677597077bbc25b

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 12 KB
6 KB 145ms
145ms XHR
application/json 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

ad3abaaeffe736d793c474b9c5f33330931cc4d757ebe4a9361abcaea4b89bc5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 1e373873-fd90-40b2-ad74-393898a566ef
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://femme4.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 117ms
116ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-4tbh
alt-svc: clear

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 42ms
17ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 40ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 59 KB
27 KB 289ms
289ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4479724155496031&correlator=2776942353711895&output=ldjh&impl=fif&eid=31063280%2C31063282%2C31061690%2C31063140&vrg=2021102501&ptt=17&sc=1&sfv=1-0-38&ecs=20211028&iu_parts=21700304385%3A22564129828%2Cfemme4%2Cfemm_adhesive&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x90%7C728x90%7C320x50%7C320x100%7C300x50%7C1x1&prev_scp=hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.12%26hb_adid%3D5824d74f3e1ebad%26hb_bidder%3Dappnexus&eri=5&cookie_enabled=1&cdm=femme4.com&bc=31&abxe=1&dt=1635410982116&dlt=1635410981248&idt=429&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=1150&adks=3023198139&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.femme4.com%2F&loc=https%3A%2F%2Ffemme4.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&ga_vid=1451520711.1635410982&ga_sid=1635410982&ga_hid=503897133&ga_fc=true&fws=516&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

159.248.227.35.bc.googleusercontent.com

Software

cafe /

Resource Hash

649da8f2258967427210db57f8b4a92e851f65ef3f5b6f5a316da3738ce7a4a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27855
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1F1B 6 KB
4 KB 65ms
15ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 28 Oct 2021 08:49:42 GMT
expires: Fri, 28 Oct 2022 08:49:42 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 user Show response
cdn.admatic.com.tr/ Frame CB79 251 B
629 B 52ms
8ms Document
text/html 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.admatic.com.tr/user
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-47.cdn77.com
Software: BunnyCDN-DE1-756 /
Resource Hash: 62b58b017cf4d54dc404dbc48e49b0429cbbb46678a868a95bf17664cc6340fd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-type: text/html
vary: Accept-Encoding
server: BunnyCDN-DE1-756
cdn-pullzone: 266102
cdn-uid: bea626e5-d007-4073-8941-73ce8dd2f81c
cdn-requestcountrycode: GB
cdn-edgestorageid: 756
cdn-storageserver: DE-51
cache-control: public, max-age=3600
cdn-fileserver: 141
last-modified: Thu, 11 Feb 2021 13:30:42 GMT
cdn-cachedat: 2021-08-10 09:24:38
cdn-requestpullsuccess: True
cdn-requestpullcode: 206
cdn-requestid: 80e16186bb15def916e536f55beb3ebe
cdn-status: 200
cdn-cache: HIT
content-encoding: gzip

GET

csync
sync.console.adtarget.com.tr/ Frame 25C7
Redirect Chain

https://creativecdn.com/cm-notify?pi=admatic
https://creativecdn.com/cm-notify?pi=admatic&tc=1
https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=hykmcrwCE0t27Y9pJWaP&pi=admatic&tc=1

0
0

GET
H2

200

/ Show response
ads.us.e-planning.net/uspd/1/ Frame 67AD
Redirect Chain

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID

3 KB
1 KB

18ms
17ms

Document
text/html

46.249.52.249
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.249.52.249 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: d4edc69be39313f4f62b8991a94cb08899852aed152af76ee55f62be99ab0ac5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

server: openresty
date: Thu, 28 Oct 2021 08:49:42 GMT
content-type: text/html
cache-control: max-age=0, no-cache
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
expires: Thu, 28 Oct 2021 08:49:42 GMT
x-sid: AMS-738
content-encoding: gzip

Redirect headers

server: openresty
date: Thu, 28 Oct 2021 08:49:42 GMT
content-type: text/html; charset=iso-8859-1
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
location: /uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
x-sid: AMS-738

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 58B8 14 KB
5 KB 7ms
7ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307406%26extuid%3D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=101407
expires: Fri, 29 Oct 2021 12:59:49 GMT
date: Thu, 28 Oct 2021 08:49:42 GMT
vary: Accept-Encoding

GET
H2 200 pbsync.html Show response
js.adscale.de/ Frame AD74 3 KB
2 KB 47ms
8ms Document
text/html 2600:9000:2156:b600:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:b600:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ecde72bc5d9fd5bc5150218535ae8f75ad9161924b91e64b7995c495fc90c246

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

content-type: text/html
last-modified: Thu, 28 Oct 2021 04:24:29 GMT
x-amz-version-id: bXZFQ9cpbSKFvjC_mUF8z1lrn_pDpZKb
server: AmazonS3
content-encoding: br
date: Thu, 28 Oct 2021 08:24:32 GMT
cache-control: max-age=7200
etag: W/"5550fca00caf055568d6ced373f2721f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: o5MNSy_1hQxf71G4DjoBSTyIJ6VfB1VL1toWiWANEuwTE60_AMBShg==
age: 1511

GET
H2 200 cookie Show response
cm.adform.net/ Frame C52C 43 B
106 B 90ms
23ms Document
image/gif 37.157.2.239
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.239 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

server: nginx
date: Thu, 28 Oct 2021 08:49:42 GMT
content-type: image/gif
content-length: 43

GET csync
sync.console.adtarget.com.tr/ Frame 128F 0
0

GET
H2 200 w_480_00001.ts Show response
video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/ 381 KB
381 KB 259ms
259ms XHR
video/mp2t 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/w_480_00001.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: eedea2b6ef24d35dac39e7a9ba9b8a81f04f09e7ba2a826e3ce00f6466ded870

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Mon, 25 Oct 2021 13:50:39 GMT
server: Tengine
etag: "6176b62f-5f318"
content-type: video/mp2t
access-control-allow-origin: *
expires: Thu, 11 Nov 2021 08:49:42 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 389912
x-proxy-cache: HIT, HIT

GET
H2 200 bundle.js Show response
cdn.admatic.com.tr/user/ Frame CB79 54 KB
20 KB 49ms
49ms Script
application/javascript 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.admatic.com.tr/user/bundle.js
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-47.cdn77.com
Software: BunnyCDN-DE1-756 /
Resource Hash: 8b5cbe512fbb056de7aa42963d3bac7e38adb05e32fbe6f502b4fad3cabf57fc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/user
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: br
cdn-edgestorageid: 756
cdn-fileserver: 141
cdn-storageserver: DE-51
cdn-cachedat: 2021-08-12 13:48:34
cdn-pullzone: 266102
last-modified: Fri, 12 Mar 2021 04:24:48 GMT
server: BunnyCDN-DE1-756
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: application/javascript
cdn-cache: HIT
cdn-uid: bea626e5-d007-4073-8941-73ce8dd2f81c
cache-control: public, max-age=3600
cdn-requestid: 8fcdcb42cc7192e366c66cae03b22d57
cdn-requestcountrycode: GB
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2

200

uu Show response
ih.adscale.de/ Frame AD74
Redirect Chain

https://ih.adscale.de/uu?cbfn=receive&t=1635410982
https://ih.adscale.de/uu?cbfn=receive&t=1635410982&nut&uu=6660be7fed8045ccac7b118b73193a16

44 B
213 B

7ms
7ms

Script
text/javascript

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/uu?cbfn=receive&t=1635410982&nut&uu=6660be7fed8045ccac7b118b73193a16
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 5eb3c232a11c151f3aa2f81a3c3c99c9f5b3d517ae4c81fb25c20bea8124fe97

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-length: 44
content-type: text/javascript;charset=ISO-8859-1

Redirect headers

location: https://ih.adscale.de/uu?cbfn=receive&t=1635410982&nut&uu=6660be7fed8045ccac7b118b73193a16
date: Thu, 28 Oct 2021 08:49:42 GMT
content-length: 0

GET
H2

200

um
u-ams02.e-planning.net/ Frame 67AD
Redirect Chain

https://pixel.sitescout.com/dmp/pixelSync?network=EPLANNING&rurl=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fuid%3D%7BUSER_ID%7D%26dc%3D0abbcb4eba840e59%26fi%3D2284aa8dfa0a9f57
https://u-ams02.e-planning.net/um?uid=no-consent&dc=0abbcb4eba840e59&fi=2284aa8dfa0a9f57

42 B
103 B

13ms
13ms

Image
image/gif

46.249.52.248
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-ams02.e-planning.net/um?uid=no-consent&dc=0abbcb4eba840e59&fi=2284aa8dfa0a9f57
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 46.249.52.248 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: openresty
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://u-ams02.e-planning.net/um?uid=no-consent&dc=0abbcb4eba840e59&fi=2284aa8dfa0a9f57
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

um
sync.e-planning.net/ Frame 67AD
Redirect Chain

https://sync.1rx.io/usersync2/eplanning
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5488731170
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5488731170
https://sync.1rx.io/usersync/tradedesk/885cb34c-bf55-48a9-adcd-4ce806d857bb
https://sync.targeting.unrulymedia.com/csync/RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3DRX-0b61018e-a540-437d-9668-e7f3ed0277b8-003%26dc%3D1079...
https://sync.e-planning.net/um?uid=RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003&dc=1079cc634ca638f8&iss=1

42 B
103 B

13ms
13ms

Image
image/gif

46.249.52.249
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?uid=RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003&dc=1079cc634ca638f8&iss=1
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 46.249.52.249 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: openresty
content-type: image/gif

Redirect headers

location: https://sync.e-planning.net/um?uid=RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003&dc=1079cc634ca638f8&iss=1
date: Thu, 28 Oct 2021 08:49:42 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX0b61018ea540437d9668e7f3ed0277b8003
content-type: text/html

GET
H2 200 dataxpand_28122020.js Show response
s.e-planning.net/esb/4/1/3fb8/8a4272ba9ae263fe/ Frame 67AD 39 KB
14 KB 66ms
21ms Script
application/x-javascript 5.178.65.253
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/1/3fb8/8a4272ba9ae263fe/dataxpand_28122020.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.178.65.253 Renswoude, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: i.e-planning.net
Software: openresty /
Resource Hash: 792e8d90eda8320b9bad0aa1aa9b98cb609ac3a72a642e6d370f40131c88ebe4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
last-modified: Mon, 28 Dec 2020 16:45:03 GMT
server: openresty
etag: W/"5fea0b8f-9a72"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Tue, 27 Oct 2026 08:49:42 GMT

GET
H2 200 retargetly_030920.js Show response
s.e-planning.net/esb/4/1/3fb8/7bb4893a30d21aef/ Frame 67AD 2 KB
1 KB 67ms
22ms Script
application/x-javascript 5.178.65.253
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/1/3fb8/7bb4893a30d21aef/retargetly_030920.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.178.65.253 Renswoude, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: i.e-planning.net
Software: openresty /
Resource Hash: 18cbfcb608af5885f7916274b60578d32006c90e8fce3d98dbcc89a646707608

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
last-modified: Thu, 03 Sep 2020 18:45:03 GMT
server: openresty
etag: W/"5f5139af-857"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Tue, 27 Oct 2026 08:49:42 GMT

GET
H2

200

um
u-ams02.e-planning.net/ Frame 67AD
Redirect Chain

https://rtb.openx.net/sync/prebid?r=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3Dff96d1aa62deeebd%26fi%3D2284aa8dfa0a9f57%26uid%3D%24%7BUID%7D
https://u-ams02.e-planning.net/um?dc=ff96d1aa62deeebd&fi=2284aa8dfa0a9f57&uid=b5346f16-74cc-473b-a46c-684bf4e0feb3

42 B
103 B

23ms
14ms

Image
image/gif

46.249.52.248
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-ams02.e-planning.net/um?dc=ff96d1aa62deeebd&fi=2284aa8dfa0a9f57&uid=b5346f16-74cc-473b-a46c-684bf4e0feb3
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 46.249.52.248 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: openresty
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://u-ams02.e-planning.net/um?dc=ff96d1aa62deeebd&fi=2284aa8dfa0a9f57&uid=b5346f16-74cc-473b-a46c-684bf4e0feb3
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: igppb3lkrsdi86p5dg6garrpcnah3ndj

GET
H/1.1 200 ptag Show response
a.audrte.com/ Frame 67AD 5 KB
2 KB 392ms
96ms Script
text/plain 18.215.193.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptag?p=M1353665098
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.215.193.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-215-193-43.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 9b5272365fcbb4729c69783c3ee5af8512c7a74503dc8946b551a20f43e1f2e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-transform, public, max-age=3600
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1682

GET
H2 200 lotame.js Show response
s.e-planning.net/esb/4/1/3fb8/69b1486c74a3b7dc/ Frame 67AD 266 B
415 B 67ms
22ms Script
application/x-javascript 5.178.65.253
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/1/3fb8/69b1486c74a3b7dc/lotame.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.178.65.253 Renswoude, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: i.e-planning.net
Software: openresty /
Resource Hash: 76d1da9e9902ccf3d2983b706151d7c4f1a910c86b757fae4302ccf989c630a7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
last-modified: Thu, 19 Nov 2020 16:18:03 GMT
server: openresty
etag: W/"5fb69abb-10a"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Tue, 27 Oct 2026 08:49:42 GMT

GET
H2 204 current
prebid-match.dotomi.com/match/bounce/ Frame 67AD 0
104 B 114ms
60ms Image
text/plain 2a02:fa8:8806:13::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid-match.dotomi.com/match/bounce/current?networkId=72582&version=1&rurl=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3Dfbb23d0ef33aad5d%26fi%3D2284aa8dfa0a9f57%26uid%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1400 , Sweden, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

/
sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/ Frame 67AD
Redirect Chain

https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=25BiP9IMgN&r=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fuid%3D[PDID]%26dc%3Dfabfd6762b833237%26fi%3D2284aa8dfa0a9f57
https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F

95 B
222 B

18ms
17ms

Image
image/png

162.55.236.224
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 162.55.236.224 , United States, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.224.236.55.162.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: nginx/1.14.2
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/png

Redirect headers

location: https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F
date: Thu, 28 Oct 2021 08:49:42 GMT
server: nginx/1.14.2
content-type: text/html; charset=UTF-8

GET
H2

200

um
u-ams02.e-planning.net/ Frame 67AD
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3D2284aa8dfa0a9f57%26uid%3D%24UID
https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=2284aa8dfa0a9f57&uid=298353389270665838

42 B
104 B

49ms
13ms

Image
image/gif

46.249.52.248
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=2284aa8dfa0a9f57&uid=298353389270665838
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 46.249.52.248 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: openresty
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: e8dc471c-9edb-4b81-8e30-d1a9c66f4793
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=2284aa8dfa0a9f57&uid=298353389270665838
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK us
sync.go.sonobi.com/ Frame 67AD 0
478 B 65ms
15ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=%0A%0Ahttps%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3De52415579699e09f%26fi%3D2284aa8dfa0a9f57%26uid%3D%5BUID%5D

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.e-planning.net/ Frame 67AD
Redirect Chain

https://ups.analytics.yahoo.com/ups/58414/occ
https://ups.analytics.yahoo.com/ups/58414/occ?verify=true
https://sync.e-planning.net/um?dc=d5ef3eaea371187e&iss=1&uid=y-IE8RuJdE2uE9paprNActl3xZsjh5yOqU4U6tkzo-~A

42 B
104 B

43ms
13ms

Image
image/gif

46.249.52.249
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?dc=d5ef3eaea371187e&iss=1&uid=y-IE8RuJdE2uE9paprNActl3xZsjh5yOqU4U6tkzo-~A
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Server: 46.249.52.249 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: openresty
content-type: image/gif

Redirect headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://sync.e-planning.net/um?dc=d5ef3eaea371187e&iss=1&uid=y-IE8RuJdE2uE9paprNActl3xZsjh5yOqU4U6tkzo-~A
Connection: keep-alive
Content-Length: 0

GET eplanning
cs.admanmedia.com/sync/ Frame 67AD 0
0

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 6A1F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=12186&endpoint=eu
https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu

281 B
554 B

41ms
7ms

Document
text/html

23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 26 Oct 2021 17:01:05 GMT
ETag: "40334-119-5cf446c48f640"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 28 Oct 2021 08:49:42 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
Date: Thu, 28 Oct 2021 08:49:42 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B4EE 14 KB
5 KB 8ms
7ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156631&s=&predirect=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3Da208d9366469aa64%26fi%3D2284aa8dfa0a9f57%26uid%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=101407
expires: Fri, 29 Oct 2021 12:59:49 GMT
date: Thu, 28 Oct 2021 08:49:42 GMT
vary: Accept-Encoding

GET
H2 200 userconnect.js Show response
js.adscale.de/ Frame AD74 14 KB
5 KB 7ms
7ms Script
application/javascript 2600:9000:2156:b600:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/userconnect.js
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:b600:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 58ed344732766704ee535508e3dcd8d4a8ec0c9c79d16adf02293adde110926c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: 17WyJolWAUQ_rIOTH_XKt_BnENk99tsx
content-encoding: gzip
last-modified: Thu, 28 Oct 2021 04:24:29 GMT
server: AmazonS3
age: 1511
etag: W/"98f37b242862929d9aef4bde91abc8ad"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
cache-control: max-age=7200
date: Thu, 28 Oct 2021 08:24:32 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: gN_zwfLcYYpxPik1GeoDQb86FfhYrKxIf6p5rVz1F97NA_9HLTcBaQ==

GET csync
sync.console.adtarget.com.tr/ Frame AD74 0
0

GET
H2 200 user Show response
ads3.admatic.com.tr/ Frame CB79 75 B
422 B 157ms
51ms XHR
application/json 188.132.147.228
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user/bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: 6a988186f83a99dc65f7add546b120045687948009a9b47e48794a94cd07ec6d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:41 GMT
content-type: application/json; charset=utf-8
server: AdMatic
x-powered-by: AdMatic
vary: Origin
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 75

GET
H2 200 userconnect Show response
ih.adscale.de/ Frame AD74 149 B
224 B 8ms
7ms Script
application/javascript 54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/userconnect?ssl=1&sid=0&cbfn=stroeerCoreConnect&ts=1635410982281&umd=false&gdpr=0&gdpr_version=2&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 3516496d97f72bf509cf5d6902b5deebf53355ccb21127dc777d265cd96ca2d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-length: 149
content-type: application/javascript

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 114ms
114ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-b4kh
alt-svc: clear

GET
H2 200 map Show response
ih.adscale.de/ Frame 3C3B 3 KB
3 KB 8ms
8ms Document
text/html 54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: c954e80b204ad2368ba1207f94ae07319315a3915a6f40ecbd09f7ef089e1280

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://js.adscale.de/

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-type: text/html;charset=ISO-8859-1
content-length: 2702

GET
H2 200 match.js Show response
js.adscale.de/ Frame 3C3B 4 KB
2 KB 7ms
7ms Script
application/javascript 2600:9000:2156:b600:f:4f64:8940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/match.js
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:b600:f:4f64:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 91b4eb09154d5ebef46352e922194ec6dbb9547b63f9776ae10133fe1ca66879

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: ez4P1Kk5jmyoRyZ5B2WVeYJN9EUaw286
content-encoding: br
last-modified: Thu, 28 Oct 2021 04:24:29 GMT
server: AmazonS3
age: 1511
etag: W/"b75124846aec28a28b7a3441813682d5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
cache-control: max-age=7200
date: Thu, 28 Oct 2021 08:24:32 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: H8_eft4rLVv9uhiBvrP9Hkkr5OhjdHr8gTenvQzsnIIX7MYFf3j91w==

GET
H/1.1 200
OK usermatch Show response
ssum.casalemedia.com/ Frame BD0D 2 KB
3 KB 43ms
20ms Document
text/html 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D2284aa8dfa0a9f57%26uid%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c0493ea2ab9d66b98f42954e880eac1fb1dd26d72c389c118f142a8691c5876f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 45|230|241|39|81|64|218|3
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Content-Length: 1732
Expires: Thu, 28 Oct 2021 08:49:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Connection: keep-alive

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 658D 2 KB
823 B 63ms
18ms Document
text/html 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5927d926323dc2c

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H2 200 / Show response
spl.zeotap.com/ Frame 6F3C 7 KB
2 KB 61ms
36ms Document
text/html 2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e34827e6726c2961a29306dc014f6fe1fa75b1e0134a058eae17dbd7cc5b045e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-type: text/html
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-origin: https://ads.us.e-planning.net
vary: Origin
via: 1.1 google
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6a52e98fa87a4aaf-FRA
content-encoding: br

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 6A1F 31 KB
10 KB 8ms
8ms Script
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: ca92d77c2d1c7c39f86a0feab4223131bea068006d0c58a75c9e951132e07731

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Oct 2021 21:13:51 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=44831
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9393
Expires: Thu, 28 Oct 2021 21:16:53 GMT

GET
H2

200

img
ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/ Frame 3C3B
Redirect Chain

https://bbnaut.ibillboard.com/match/AdScale?partneruid=6660be7fed8045ccac7b118b73193a16&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F06069d83da0546749c05909eae9e0661%2F1635410982298%2F0%2Fimg%3Ftpid%...
https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/img?tpid=101&tpuid=BBID-01-03101249823910313-16431516

49 B
463 B

9ms
8ms

Image
image/gif

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/img?tpid=101&tpuid=BBID-01-03101249823910313-16431516
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: nginx
Transfer-Encoding: chunked
p3p: CP="CUR ADM DEV OUR STP PRE DSP NOI COR NID"
Location: https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/img?tpid=101&tpuid=BBID-01-03101249823910313-16431516
Cache-Control: private, max-age=3600
Access-Control-Allow-Credentials: true
Connection: close

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 6A1F 284 B
536 B 47ms
8ms Image
image/jpg 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=12186&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Content-Type: image/jpg

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame BD0D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YXpkJTzVeRb.zY8hHFdTTwAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEKrGa30JbIWTG_6yvwr9R3w&google_cver=1&gdpr=1&google_hm=2

43 B
1 KB

31ms
31ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEKrGa30JbIWTG_6yvwr9R3w&google_cver=1&gdpr=1&google_hm=2
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D2284aa8dfa0a9f57%26uid%3D
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:42 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEKrGa30JbIWTG_6yvwr9R3w&google_cver=1&gdpr=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 341
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame BD0D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&gdpr_consent=&us_privacy=&gdpr=1
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm=&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&gdpr_consent=&us_privacy=&gdpr=1&google_tc=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEOk69aLLPaY6JZNUdINQ0BU&google_cver=1

43 B
315 B

25ms
25ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEOk69aLLPaY6JZNUdINQ0BU&google_cver=1
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D2284aa8dfa0a9f57%26uid%3D
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:42 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEOk69aLLPaY6JZNUdINQ0BU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 343
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame BD0D
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&dcc=t

43 B
645 B

100ms
100ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&dcc=t

Requested by

Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D2284aa8dfa0a9f57%26uid%3D

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 86NERPMV9W4F7482746V
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: MV4BKJS8HGEFXQX4SENH
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame BD0D 70 B
264 B 33ms
31ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D2284aa8dfa0a9f57%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET p-Z8PuJEk6U7Hyq.gif
pixel.quantserve.com/pixel/ Frame BD0D 0
0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BD0D
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48&gdpr=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1638002982

43 B
982 B

34ms
21ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1638002982
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D2284aa8dfa0a9f57%26uid%3D
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:42 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:41 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1638002982
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1 200
OK ibs:dpid=23728&dpuuid=YXpkJTzVeRb.zY8hHFdTTwAA%261119
dpm.demdex.net/ Frame BD0D 0
0 125ms
31ms Image
application/json 108.128.101.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpm.demdex.net/ibs:dpid=23728&dpuuid=YXpkJTzVeRb.zY8hHFdTTwAA%261119?gdpr_consent=&us_privacy=&gdpr=1
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D2284aa8dfa0a9f57%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.128.101.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-108-128-101-122.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame BD0D
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D&gdpr=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=db50617a-6426-4200-a358-7f8332f459f4&gdpr=1&gdpr_consent=

43 B
1018 B

17ms
17ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=db50617a-6426-4200-a358-7f8332f459f4&gdpr=1&gdpr_consent=
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D2284aa8dfa0a9f57%26uid%3D
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:42 GMT

Redirect headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: MT3 4044 0c7f252 master cdg-pixel-x12 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=db50617a-6426-4200-a358-7f8332f459f4&gdpr=1&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 28 Oct 2021 08:49:41 GMT

GET
H2 200 um
u-ams02.e-planning.net/ Frame BD0D 42 B
103 B 13ms
13ms Image
image/gif 46.249.52.248
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-ams02.e-planning.net/um?dc=99e41df815fd80b4&fi=2284aa8dfa0a9f57&uid=YXpkJTzVeRb.zY8hHFdTTwAA%261119
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3D2284aa8dfa0a9f57%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.249.52.248 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: openresty
content-type: image/gif

GET
H/1.1 400
Request failed due to privacy signals getuid
ib.adnxs.com/ Frame 6F3C 0
0 7ms
7ms Image
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/getuid?https://mwzeom.zeotap.com/mw?adnxs_uid=$UID&zpartnerid=2&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72...
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm=&zpartnerid=1&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-7...
https://mwzeom.zeotap.com/mw?google_gid=CAESEEdTDq35ymCs_adF2y4WLSg&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f...

95 B
153 B

25ms
24ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?google_gid=CAESEEdTDq35ymCs_adF2y4WLSg&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9907a0f4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://mwzeom.zeotap.com/mw?google_gid=CAESEEdTDq35ymCs_adF2y4WLSg&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 470
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://pixel.tapad.com/idsync/ex/push?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26...
https://pixel.tapad.com/idsync/ex/push/check?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent...
https://mwzeom.zeotap.com/mw?cid=047ce5c1-1bdf-4b72-b28c-07157519c38f&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c...

95 B
153 B

18ms
17ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=047ce5c1-1bdf-4b72-b28c-07157519c38f&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9907a0c4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?cid=047ce5c1-1bdf-4b72-b28c-07157519c38f&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 403 /
dmp.adform.net/serving/cookie/match/ Frame 6F3C 0
331 B 102ms
21ms Image
text/plain 37.157.6.245
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1105&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361

Requested by

Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.245 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Db7726b01-f8da-46a6-72e2-6d1c34a9af88%26reqId%3Df...
https://mwzeom.zeotap.com/mw?cid=885cb34c-bf55-48a9-adcd-4ce806d857bb&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c...

95 B
181 B

31ms
21ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=885cb34c-bf55-48a9-adcd-4ce806d857bb&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e99069df4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://mwzeom.zeotap.com/mw?cid=885cb34c-bf55-48a9-adcd-4ce806d857bb&zpartnerid=6&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 481

GET
H2 200 cm
trc.taboola.com/sg/zeotap/1/ Frame 6F3C 0
161 B 37ms
14ms Image
text/plain 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/zeotap/1/cm?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-vcl-time-ms: 9
date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 varnish
server: nginx
x-timer: S1635410982.428484,VS0,VE9
x-cache: MISS
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
x-served-by: cache-fra19123-FRA

GET
H/1.1 200
OK u
dmp.v.fwmrm.net/ad/ Frame 6F3C 0
361 B 624ms
102ms Image
text/html 2607:ae80:2::49
FREEWHEEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.v.fwmrm.net/ad/u?mode=echo&cr=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1368%26env%3DmWeb%26cid%3D%23%7Buser.id%7D%26gdpr%3D%24%7BGDPR_ENFORCED%7D%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2607:ae80:2::49 , United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Cache-Control: no-store
Expires: 0
Content-Type: text/html
Content-Length: 0
P3P: policyref="https://www.freewheel.tv/w3c/p3p.xml",CP="ALL DSP COR NID"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?gdpr=0&gdpr_consent=&rd=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1384%26env%3DmWeb%26cid%3D%23PM_USER_ID%26env%3DmWeb%26eventType%3Dmap...
https://image6.pubmatic.com/AdServer/UCookieSetPug?gdpr=0&gdpr_consent=&rd=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1384%26env%3DmWeb%26cid%3D%23PM_USER_ID%26env%3DmWeb%26eventType%3Dmap...
https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&cid=09BEBBCC-73AE-48D7-97BF-14748C773232&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f...

95 B
153 B

19ms
18ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&cid=09BEBBCC-73AE-48D7-97BF-14748C773232&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e99069e44aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&cid=09BEBBCC-73AE-48D7-97BF-14748C773232&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://sync.tidaltv.com/genericusersync.ashx?dpid=3169&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
https://sync.tidaltv.com/genericusersync.ashx?dpid=3169&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=136...
https://mwzeom.zeotap.com/mw?cid=4a9d9d76-8c19-4202-a188-85eddd706808&zpartnerid=317&gdpr=1&gdpr_consent=

95 B
153 B

16ms
16ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=4a9d9d76-8c19-4202-a188-85eddd706808&zpartnerid=317&gdpr=1&gdpr_consent=
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9916b9c4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: Apache-Coyote/1.1
location: https://mwzeom.zeotap.com/mw?cid=4a9d9d76-8c19-4202-a188-85eddd706808&zpartnerid=317&gdpr=1&gdpr_consent=
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
x-xss-protection: 1; mode=block
expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://dpm.demdex.net/ibs:dpid=199624&dpuuid=b7726b01-f8da-46a6-72e2-6d1c34a9af88&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3D...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=199624&dpuuid=b7726b01-f8da-46a6-72e2-6d1c34a9af88&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env...
https://mwzeom.zeotap.com/mw?cid=57817867814024164383071710202362803322&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-...

95 B
153 B

19ms
18ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=57817867814024164383071710202362803322&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9912b434aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

DCS: dcs-prod-irl1-2-v019-0abf208d3.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: Ye9IDe5DQmM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://mwzeom.zeotap.com/mw?cid=57817867814024164383071710202362803322&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 204 /
loadeu.exelator.com/load/ Frame 6F3C 0
324 B 131ms
28ms Image
text/plain 34.254.143.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadeu.exelator.com/load/?p=709&g=008&j=0&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.143.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-143-3.eu-west-1.compute.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%25%25COOKIE%25%25%26env%3DmWeb%26zpartnerid%3D563%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_con...
https://mwzeom.zeotap.com/mw?cid=7024036683217238170&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-...

95 B
153 B

36ms
27ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=7024036683217238170&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e99069de4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

Location: https://mwzeom.zeotap.com/mw?cid=7024036683217238170&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/ Frame 6F3C
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=2885&partner_device_id=b7726b01-f8da-46a6-72e2-6d1c34a9af88
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=b7726b01-f8da-46a6-72e2-6d1c34a9af88

95 B
425 B

15ms
14ms

Image
image/png

35.227.248.159
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=b7726b01-f8da-46a6-72e2-6d1c34a9af88

Requested by

Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Protocol

Server

35.227.248.159 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
content-type: image/png
alt-svc: clear
content-length: 95
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=b7726b01-f8da-46a6-72e2-6d1c34a9af88
date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://idsync.frontend.weborama.fr/ids?key=zeotap&value=b7726b01-f8da-46a6-72e2-6d1c34a9af88&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26...
https://idsync.frontend.weborama.fr/ids?key=zeotap&value=b7726b01-f8da-46a6-72e2-6d1c34a9af88&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26...
https://mwzeom.zeotap.com/mw?webouuid=Jo2KWyyhwUxM9H/IM5SYKe&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-40...

95 B
153 B

24ms
24ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?webouuid=Jo2KWyyhwUxM9H/IM5SYKe&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e990aa604aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
last-modified: Thu, 28 Oct 2021 08:49:42 GMT
server: nginx/1.12.0
location: https://mwzeom.zeotap.com/mw?webouuid=Jo2KWyyhwUxM9H/IM5SYKe&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: clear
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://sync.smartadserver.com/getuid?gdpr=0&gdpr_consent=&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D[sas_uid]%26zpartnerid%3D592%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%...
https://sync.smartadserver.com/getuid?gdpr=0&gdpr_consent=&url=https://mwzeom.zeotap.com/mw?cid=[sas_uid]&zpartnerid=592&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2...
https://mwzeom.zeotap.com/mw?cid=8416844214761181638

95 B
153 B

31ms
31ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=8416844214761181638
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9914b6e4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?cid=8416844214761181638
pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://bcp.crwdcntrl.net/map/c=13620/tp=ZEOT/tpid=b7726b01-f8da-46a6-72e2-6d1c34a9af88?https://mwzeom.zeotap.com/mw?pid=${profile_id}&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_con...
https://bcp.crwdcntrl.net/map/ct=y/c=13620/tp=ZEOT/tpid=b7726b01-f8da-46a6-72e2-6d1c34a9af88?https://mwzeom.zeotap.com/mw?pid=${profile_id}&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdp...
https://mwzeom.zeotap.com/mw?pid=fac57eeab449084af4459dc8ffbb51a2&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b0...

95 B
153 B

19ms
18ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?pid=fac57eeab449084af4459dc8ffbb51a2&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9919c0a4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://mwzeom.zeotap.com/mw?pid=fac57eeab449084af4459dc8ffbb51a2&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
cache-control: no-cache
x-server: 10.45.0.206
content-length: 0
expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ZTAP
https://mwzeom.zeotap.com/mw?cid=y-ISPC1sZE2oq0SWaSfeaXqKPxk5w0EWxK0Q--~A&zpartnerid=570&env=mWeb

95 B
153 B

16ms
16ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=y-ISPC1sZE2oq0SWaSfeaXqKPxk5w0EWxK0Q--~A&zpartnerid=570&env=mWeb
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9914b824aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

date: Thu, 28 Oct 2021 08:49:42 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: text/html;charset=utf-8
location: https://mwzeom.zeotap.com/mw?cid=y-ISPC1sZE2oq0SWaSfeaXqKPxk5w0EWxK0Q--~A&zpartnerid=570&env=mWeb
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
content-length: 0
x-content-type-options: nosniff

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9212299398&zctry=GBR&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zd...
https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=GBR&zdid=1361&cid=S3l28nZBcj%2FBTzlHbP7JxWbxjmdP97fz%2BS41iYitP1U%3D

95 B
153 B

23ms
23ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=GBR&zdid=1361&cid=S3l28nZBcj%2FBTzlHbP7JxWbxjmdP97fz%2BS41iYitP1U%3D
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9912b2f4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: AAWebServer
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=GBR&zdid=1361&cid=S3l28nZBcj%2FBTzlHbP7JxWbxjmdP97fz%2BS41iYitP1U%3D
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H2 200 v2
odr.mookie1.com/t/ Frame 6F3C 43 B
324 B 50ms
15ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2?tagid=V2_746632&src.visitorId=b7726b01-f8da-46a6-72e2-6d1c34a9af88&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 6F3C 0
338 B 103ms
31ms Image
text/plain 34.255.77.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=141838&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.77.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-77-76.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
cache-control: private, no-cache, no-store
x-request-time: D=33 t=1635410982
x-served-by: beacon-n020-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 /
sync.richaudience.com/1988B3F6BED450961C9D70DD91/ Frame 6F3C 95 B
360 B 18ms
14ms Image
image/png 162.55.236.224
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/1988B3F6BED450961C9D70DD91/?uuid=b7726b01-f8da-46a6-72e2-6d1c34a9af88&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 162.55.236.224 , United States, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.224.236.55.162.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: nginx/1.14.2
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/png

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_co...
https://sync-tm.everesttech.net/ct/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr...
https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=YXpkJgAAOsFWXwBR&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c85...

95 B
153 B

25ms
25ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=YXpkJgAAOsFWXwBR&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361&_test=YXpkJgAAOsFWXwBR
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e991cc524aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1635410983.679171,VS0,VE0
x-served-by: cache-fra19120-FRA
x-cache: HIT
location: https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=YXpkJgAAOsFWXwBR&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361&_test=YXpkJgAAOsFWXwBR
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 204 v1
engine.widespace.com/map/ext/api/trackingcallback/ Frame 6F3C 0
76 B 101ms
29ms Image
text/plain 34.248.235.77
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://engine.widespace.com/map/ext/api/trackingcallback/v1?accessToken=zeotap-user-sync&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.248.235.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-235-77.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: nginx/1.20.1

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 6F3C
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03e...

0
337 B

31ms
31ms

Image
text/plain

34.255.77.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 34.255.77.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-77-76.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
cache-control: private, no-cache, no-store
x-request-time: D=34 t=1635410982
x-served-by: beacon-n014-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
date: Thu, 28 Oct 2021 08:49:42 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a006-ash-prod.krxd.net

GET
H/1.1

200
OK

dcm
aax-eu.amazon-adsystem.com/s/ Frame 6F3C
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=b7726b01-f8da-46a6-72e2-6d1c34a9af88&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e...
https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=b7726b01-f8da-46a6-72e2-6d1c34a9af88&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e...

43 B
645 B

31ms
31ms

Image
image/gif

52.94.223.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=b7726b01-f8da-46a6-72e2-6d1c34a9af88&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361&dcc=t

Requested by

Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Protocol

HTTP/1.1

Server

52.94.223.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 3YN3CR27G13Y6H0D1FM3
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 84Z673FT5YC26XJ0R2J9
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=b7726b01-f8da-46a6-72e2-6d1c34a9af88&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://tags.bluekai.com/site/87734?id=b7726b01-f8da-46a6-72e2-6d1c34a9af88&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1202%26env%3DmWeb%26cid%3D%24_BK_UUID%26BK...
https://mwzeom.zeotap.com/mw?zpartnerid=1202&env=mWeb&cid=$_BK_UUID&BK_SWAP_DEST=87734

95 B
153 B

22ms
22ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1202&env=mWeb&cid=$_BK_UUID&BK_SWAP_DEST=87734
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9929d8c4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

Location: https://mwzeom.zeotap.com/mw?zpartnerid=1202&env=mWeb&cid=$_BK_UUID&BK_SWAP_DEST=87734
Date: Thu, 28 Oct 2021 08:49:42 GMT
Connection: keep-alive
Content-Length: 0
BK-Server: 4fc9
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6F3C
Redirect Chain

https://obgpm76tt0a0sgozk8l.redinuid.imrworldwide.com/zeo?url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1395%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3Db7726...
https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361

95 B
153 B

17ms
17ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 6a52e9924cfe4aaf-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=b7726b01-f8da-46a6-72e2-6d1c34a9af88&reqId=fe6c1f69-b01a-406c-72a1-c851c03ece3c&zdid=1361
date: Thu, 28 Oct 2021 08:49:42 GMT
cross-origin-resource-policy: cross-origin
content-length: 0

GET
H2 200 container.html Show response
e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F6CD 6 KB
3 KB 308ms
7ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 28 Oct 2021 08:49:42 GMT
expires: Fri, 28 Oct 2022 08:49:42 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 44ms
22ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021102501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c12d60ba65020e9ed64b091524cce44a47f012267902e43dc58f6a7208341db1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 8640
x-xss-protection: 0

GET
H2 200 new Show response
ads3.admatic.com.tr/user/ Frame CB79 169 B
330 B 51ms
51ms XHR
application/json 188.132.147.228
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user/new
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user/bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: d357909719fea2165a82171e5c8f76beea51727f28098cf79a3f3be8a61551b5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:42 GMT
etag: GWJLwJ4XPpqYAetl7YGjpb1MSyEUY1J7xF5EGpeW9AwJptUVlBS4CKikc3MNSLFg4iMsRC3fpWDs8z2WCieohA
last-modified: Thu, 28 Oct 2021 09:49:42 GMT
server: AdMatic
x-powered-by: AdMatic
vary: Origin
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 169

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame A04C 370 KB
123 KB 69ms
19ms Script
text/javascript 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a095c4b655aa774d4b1eb479908d0aa5ce3482b701c4b25af75050e0fe85ebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 125402
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Thu, 28 Oct 2021 08:49:42 GMT

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 3C3B
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=26&redir=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D108%26tpuid%3D%5BMM_UUID%5D&uid=3da6b194d108bc953eeca5f...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=108&tpuid=db50617a-6426-4200-a358-7f8332f459f4&gdpr=0&gdpr_consent=

49 B
559 B

9ms
9ms

Image
image/gif

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=108&tpuid=db50617a-6426-4200-a358-7f8332f459f4&gdpr=0&gdpr_consent=
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: MT3 4044 0c7f252 master cdg-pixel-x7 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=108&tpuid=db50617a-6426-4200-a358-7f8332f459f4&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 28 Oct 2021 08:49:41 GMT

GET
H2

200

img
ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/ Frame 3C3B
Redirect Chain

https://adscale-emea.adnxs.com/getuid?https%3A%2F%2Fih.adscale.de%2Fsium%2F06069d83da0546749c05909eae9e0661%2F1635410982298%2F0%2Fimg%3Ftpid%3D75%26tpuid%3D%24UID&gdpr=0
https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/img?tpid=75&tpuid=298353389270665838&gdpr=0

49 B
569 B

12ms
12ms

Image
image/gif

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/img?tpid=75&tpuid=298353389270665838&gdpr=0
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 863.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 09bec967-8641-4c74-80ac-93f2f554e124
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/img?tpid=75&tpuid=298353389270665838&gdpr=0
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 w_480_00002.ts Show response
video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/ 311 KB
312 KB 89ms
88ms XHR
video/mp2t 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/w_480_00002.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 2466ebef17d307ea156a1c6da72f46965350aec7933711ed45ef4cd3975fd7dd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Mon, 25 Oct 2021 13:50:40 GMT
server: Tengine
etag: "6176b630-4dcc4"
content-type: video/mp2t
access-control-allow-origin: *
expires: Thu, 11 Nov 2021 08:49:42 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 318660
x-proxy-cache: HIT, HIT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 45ms
23ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 28 Oct 2021 08:49:42 GMT

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
158 B 97ms
97ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=aYHEBY2cyr64kvaKjGFx_2
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: c81c49d2673bee8c92cc55ff0ee35b3c0897a046d42d1b49d2d856a6c206fcdd

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 c Show response
prebid.a-mo.net/a/ 26 KB
15 KB 405ms
405ms XHR
application/json 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: ecc7c94c68a9169694afeb08005957ca8e92a30a49edc9fb2d2720558b20e93a

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 229
content-length: 15446

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 12 KB
7 KB 263ms
250ms XHR
application/json 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

43c5e5224fc916bb96d9a601bfb2807e825a443e27c5f5a9e699a2861527ddee

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: ad4e6c7b-8eef-42b7-9f16-7f3ee8cb1709
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://femme4.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
77 B 110ms
110ms XHR
text/html 34.107.161.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://femme4.com
x-cloud-trace-context: d7ad87bae66483e8d1eba2baf72a2ef5
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
42 B 112ms
112ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-b4kh
alt-svc: clear

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 21ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 317ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
9 KB 335ms
334ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4479724155496031&correlator=1161583836839395&output=ldjh&impl=fif&eid=31063280%2C31063282%2C31061690%2C31063140&vrg=2021102501&ptt=17&sc=1&sfv=1-0-38&ecs=20211028&iu_parts=21700304385%3A22564129828%2Cfemme4%2Cfemm_sidebar_2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250%7C300x600%7C160x600&fluid=height&prev_scp=hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.02%26hb_adid%3D599fd9d874e835e%26hb_bidder%3Dappnexus&eri=5&cookie=ID%3D088639ec3b077111-22ed15d903cb00c2%3AT%3D1635410982%3AS%3DALNI_Ma7TDohIMQV4SbPsUM0R3792CsT7w&cdm=femme4.com&bc=31&abxe=1&dt=1635410982499&dlt=1635410981248&idt=429&frm=20&biw=1600&bih=1200&oid=2&adxs=1066&adys=1277&adks=4061998808&ucis=2&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.femme4.com%2F&loc=https%3A%2F%2Ffemme4.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=308x0&msz=308x0&ga_vid=1451520711.1635410982&ga_sid=1635410982&ga_hid=503897133&ga_fc=true&fws=4&ohw=1600&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

212-129-3-112.rev.poneytelecom.eu

Software

cafe /

Resource Hash

5c5022ac4a7be646851253d39e7f7503a66c616cce98037a9759534894e696b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 8878
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET csync
sync.console.adtarget.com.tr/ Frame CB79 0
0

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 3C3B
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=183592&cb=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D63%26tpuid%3D__UID__&uid=6b95e3bd6c598da4251686cff...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YXpkJTzVeRb.zY8hHFdTTwAA%261119

49 B
589 B

9ms
8ms

Image
image/gif

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YXpkJTzVeRb.zY8hHFdTTwAA%261119
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YXpkJTzVeRb.zY8hHFdTTwAA%261119
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 310
Expires: Thu, 28 Oct 2021 08:49:42 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 8106 12 KB
5 KB 8ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Thu, 28 Oct 2021 07:35:36 GMT
expires: Fri, 28 Oct 2022 07:35:36 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 4446
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 7BAA 783 B
1 KB 39ms
16ms Document
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e17100d5645acdad852ef5e3105befad76283df457f051d765b936d83beff161

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ER38iKwpbtmWKsUpW1aIpw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 28 Oct 2021 08:49:42 GMT
date: Thu, 28 Oct 2021 08:49:42 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-ER38iKwpbtmWKsUpW1aIpw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 bridge3.486.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame 3862 578 KB
190 KB 309ms
6ms Document
text/html 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e8c2a07175788df50b2ce8963f1f28fb6d0f88d26438f10b9575e99f9f4c020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 194260
date: Fri, 22 Oct 2021 01:55:39 GMT
expires: Sat, 22 Oct 2022 01:55:39 GMT
last-modified: Wed, 20 Oct 2021 22:06:14 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 543243
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame A04C 44 KB
17 KB 56ms
21ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 08:49:42 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A04C 107 B
165 B 252ms
25ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2

200

img
ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/ Frame 3C3B
Redirect Chain

https://track.adform.net/serving/cookie/match/?party=9&uid=495981f7c8f60188d5e53f6146969026d02d92850985aae5b6c953208d5750c6&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F06069d83da0546749c0590...
https://track.adform.net/serving/cookie/match/?CC=1&party=9&uid=495981f7c8f60188d5e53f6146969026d02d92850985aae5b6c953208d5750c6&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F06069d83da0546749...
https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/img?tpid=42&gdpr=0&tpuid=6286582831658030246

49 B
598 B

8ms
8ms

Image
image/gif

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/img?tpid=42&gdpr=0&tpuid=6286582831658030246
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: nginx
location: https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/img?tpid=42&gdpr=0&tpuid=6286582831658030246
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 7BAA 0
0 68ms
47ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021102501&jk=4479724155496031&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js Show response
pagead2.googlesyndication.com/bg/ Frame 8106 35 KB
14 KB 26ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad8b12962ae8e7b1e5a90d30d5daf381777909bcc20b06faa9d148b888f6cc8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 08:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89298
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13232
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 08:01:24 GMT

GET
H2 200 w_480_00003.ts Show response
video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/ 407 KB
407 KB 16ms
16ms XHR
video/mp2t 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/w_480_00003.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: 2cdaf58b31a70a89825d56cce69f0a7579376875045171480b69e07b4965fbf8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Mon, 25 Oct 2021 13:50:40 GMT
server: Tengine
etag: "6176b630-65aa4"
content-type: video/mp2t
access-control-allow-origin: *
expires: Thu, 11 Nov 2021 08:49:42 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 416420
x-proxy-cache: HIT, HIT

GET
H2 200 cc.js Show response
tags.crwdcntrl.net/c/15238/ Frame 67AD 38 KB
11 KB 35ms
8ms Script
application/json 143.204.98.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/c/15238/cc.js?ns=_cc15238
Requested by: Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/1/3fb8/69b1486c74a3b7dc/lotame.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.104 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-104.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1844237c138bd410bc7fcfecd38156aa58aa2968d59889386b17de5c796e3c84

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 17:15:20 GMT
content-encoding: gzip
etag: W/"2b2f816f40499d384e118ce88a266e02"
last-modified: Thu, 02 Jul 2020 15:35:12 GMT
server: AmazonS3
age: 56063
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
via: 1.1 ba77f90aac0ddbc2c4c2c02062fac762.cloudfront.net (CloudFront)
cache-control: max-age: 86400
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: qVci-0L7kscL-Kbo1cdrDeKSvqkiwLZvPkDtEqhZ865mpxnqSjp-aA==

GET
H2 200 sirdata_03022021.html Show response
s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/ Frame B132 636 B
577 B 14ms
14ms Document
text/html 5.178.65.253
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.178.65.253 Renswoude, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: i.e-planning.net
Software: openresty /
Resource Hash: 14d79e2cf47df339b79d25ffc6d0136e5d2e70a96b75e6782198ea6bbda3ca0a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

server: openresty
date: Thu, 28 Oct 2021 08:49:42 GMT
content-type: text/html
last-modified: Wed, 03 Feb 2021 21:18:20 GMT
etag: W/"601b131c-27c"
expires: Tue, 27 Oct 2026 08:49:42 GMT
cache-control: max-age=157680000
access-control-allow-origin: *
content-encoding: gzip

GET
H2 200 e-planning Show response
sync.quantumdex.io/usersync/ Frame B8DD 2 KB
959 B 176ms
151ms Document
text/html 2606:4700:10::6816:397e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/usersync/e-planning
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:397e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2fb2125bf949a59558e2627022d22c0cc4d2246e38041b3486d24898e1f62ab0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-type: text/html
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6a52e991d8a2698f-FRA
content-encoding: gzip

GET csync
sync.console.adtarget.com.tr/ Frame 13B8 0
0

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 3C3B
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=17&p=32&cp=adscale&url=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D40%26tpuid%3D%40%40CRITEO_USERID%40%40&u...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=0624053b-4820-4079-a7f8-eaba7d35b3e6&gdpr=0

49 B
621 B

11ms
11ms

Image
image/gif

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=0624053b-4820-4079-a7f8-eaba7d35b3e6&gdpr=0
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: Kestrel
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=0624053b-4820-4079-a7f8-eaba7d35b3e6&gdpr=0
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1407314
content-length: 0
expires: Thu, 28 Oct 2021 00:00:00 GMT

GET
H/1.1 200
OK GS.d Show response
js.cookieless-data.com/ Frame B132 0
535 B 80ms
28ms Script
text/plain 212.129.3.112
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://js.cookieless-data.com/GS.d?pa=24492&cmp=0&si=1&u=https%3A%2F%2Fs.e-planning.net%2Fesb%2F4%2F0%2F1992d%2Fbb6e7a161f794f56%2Fsirdata_03022021.html&r=https%3A%2F%2Fads.us.e-planning.net%2F&s=&rand=1635410982689

Requested by

Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.129.3.112 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

Software

nginx/1.11.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains; preload
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: nginx/1.11.3
Strict-Transport-Security: max-age=15724800; includeSubDomains; preload
P3p: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 0
X-Xss-Protection: 0
Expires: Tue, 01 Jan 2000 00:00:00 GMT

GET
H2 200 w_480_00004.ts Show response
video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/ 471 KB
471 KB 15ms
14ms XHR
video/mp2t 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/w_480_00004.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: f24bccd07c9101aec316e373689774aa122245130868d77ab007612fdb00ff88

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Mon, 25 Oct 2021 13:50:41 GMT
server: Tengine
etag: "6176b631-75a34"
content-type: video/mp2t
access-control-allow-origin: *
expires: Thu, 11 Nov 2021 08:49:42 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 481844
x-proxy-cache: HIT, HIT

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 3C3B
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=26&redir=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D39%26tpuid%3D%5BMM_UUID%5D&uid=d3bab125c8f8e5cb1d0fe499...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=db50617a-6426-4200-a358-7f8332f459f4&gdpr=0&gdpr_consent=

49 B
643 B

8ms
8ms

Image
image/gif

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=db50617a-6426-4200-a358-7f8332f459f4&gdpr=0&gdpr_consent=
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: MT3 4044 0c7f252 master cdg-pixel-x11 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=db50617a-6426-4200-a358-7f8332f459f4&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 28 Oct 2021 08:49:41 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DC39 624 B
733 B 39ms
18ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJKm1AIQlZHVAhik0bW3ATAB&v=APEucNWKhs2hvc7QeUUB47LjPV0AqOLU5tEaskSPN1CNf59hB3pfugOtJkIASp19pxKz-x3TiSlRCUa6FiFh_29kWIIe57Nalr_ImnVsvCe7CtP0q2QWjpRHVkqQFleuWJHxnaQacaleT7mosRR3hXSydDrJ_VLxCDZ8dnN15JO90foQP7ri6NI

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 28 Oct 2021 08:49:42 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/ Frame F6CD 18 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/abg_lite_fy2019.js

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64f935ff5fca279f250a216623f16404cabd9fb67ed5659f0ac089990652e159

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:47:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 117
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7700
x-xss-protection: 0
server: cafe
etag: 14378044041589781240
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:47:45 GMT

GET
H2 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/ Frame F6CD 6 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fb9268e99659f17a183de7aa0d4e27453f96c159a7ba99d6482522f8f72d1009

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:44:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 321
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2631
x-xss-protection: 0
server: cafe
etag: 10983085961369067521
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:44:21 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F6CD 0
542 B 88ms
52ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvisICKyN5vYx0sPRAF6sUcazlGYxmi2BRsjlBMZTPa5RSKezs7yWcVZRXWvPXO8v_ZtoKk1Rchdy5dyDuzN8_ARiUadUiRQNdm_HfOipZPOt0rHqadtmsbEHJdVgTHbb_dFV8UZGb3ZuecPkrSRnghwJKfaC-RSgJ1r7bI8LAs67f3kHNeYG1jSNv5gOK9Jvw0sme_FrnwaLwQIO8dAPGSNfiNFA2Nt8J3DyN1WckYr0GZ-eBdNvMMeZ_CHbwzjgLfA0Z1bjn7TRcZC62hOcVv4iN59ZsMhwjZRX-Wh1rXCUMmaXOKfSOzI9_EF0OQvwu5gdtZm9ndbXrMkVVGANmHm4F1NoGt89_6l6l5M5duvTXDCwYUJ4ONk9PlPeGOnaPjqdGoEYIsaMfL8EtOGuc0rn0UlMDLQ9ly_fX2eAhlglgQiDS1ToI9_F5rO9ZDT1qow-4qH_DozAgZp_nnSh2CV82P-_4zIgufA1Ttwd1KG0uIMm-b0SRWWsjKXxlu2GPzxGGgmgjvbRboQ9CwP5StFWl7xFHLjGglX2MGbG-l0l8ABiQaYjPas1K9OcJ_9L9OFF4WditRR1TuBpku21iyEV3s1ZHLS9Ii0GjBpFN8vgCrgU3YCCkCXlwlKHdbbdaglEGiWinGcDNHbGbSsdQCqDsLk_241JfyI09yZbgOpmJzUCXJa8tWy8oRzLXL1ThjGl_hZIXfqkSFA9o4zj_LgsqRvgBgU4egOY_jSxeTkkZYtT327iZ6oc7WqpW2I7VoKFDYPyCr8-0xEcF96d1b_2WrJHBgvBfaM4wdGi9XuC7f-yR6gvdkSj3AVoT1tKob_zB52b-7uzmP7bs7lhAs19gi_lMpgQmsRonwgyTnvk6-Lv-3dZwo-CEsLtmnRqxMLHyu3wzweticMDheuw5AC7sT0sTkX_jhY-jIzgTKQ0_hpBYLvgIxCgRxa_iaEXiJdMGdRQE6ynwPetJJ2Qh7f--pkb-pBRyTwgmZxkbcXmBA8PhPatWrVCDC0SJtTHB_S0-oOCMlazfPiaAGxrvnp8AzTezILA57YHIVgyPQ8ZqlibljP0ObHhf9114-oEbeVgbgTgdrFcMA_-FAgMIyhuFYJ1ZiPX81OWywE2DBJF8bcBNnWHDPIVe5Lidl7ACE7sZ9IZEGspJQuoW3Zza5tBUI7F4AkF0eLQ&sai=AMfl-YSVJwsU7CaPBebqS8sye_k3uOSnJWJOT1r2-ZwpWkeAQGgMFbGPgj3wH1aRKLDILyXa126vqJPmtWFCOdi4B4s1xuc95wD7au4ZM7srmcsTMGzbJs9ogBQv2-voI62VJBwrZU6OGRG02HLo52lRBeDt-QcMs3YUNwMHRKZk_yWFxwY4QH74zCTEC2L5X9dq5Khwz7_x8jmbkmqY27xk0M6in-j828iPvGA6Q_hcbqbuoLeZROFp78r25v_evJd0IBkTCIWKMEcg6Zq7lflzWZtyhFid_qrXnREgx2_Ufq9K9_WJI-jnxhYx7q0NpCKTl23KOf-Yaoz4DFAgFCdbb1dbXdmD9AmkF48Xdyu5pAyKRW6QYcGEDOTeLxFUpJXN9aU8BgVpv6LLmjk&sig=Cg0ArKJSzOQj2pTs-vfXEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20211026.33877&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F6CD 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 14:26:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66221
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 27 Oct 2022 14:26:01 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F6CD 42 B
173 B 40ms
39ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BlZYw-CkoY2sHVH5yj2hFIXcA1Vib5UIlAvQYK-HlfoX4KgLdtJgbl2aaokzHVG17pzd1TQdUQSx5WHm3Q76wC2FxydXdqjXU6jfNaDObLgP3eJf0

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame F6CD 3 KB
2 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/window_focus_fy2019.js

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:46:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 183
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:46:39 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F6CD 120 KB
37 KB 61ms
25ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635161763799786"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 28 Oct 2021 08:49:42 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame F6CD 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:46:13 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F6CD 0
0 15ms
14ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSY-MRpnZNnHmhGcDVh2FscDsOI7CRCbjcT6-AzW698avCXBENFP0lO2PPMl9AVK6UXp7WihklFAlAOSHgfVJtwsIMKow
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 10179969219254374141
s0.2mdn.net/simgad/ Frame F6CD 70 KB
70 KB 309ms
7ms Image
image/jpeg 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10179969219254374141

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2a5a99d8f8ef56def811b8adad5c86d6d309a093a1c79370bd5ede23bb2cc4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 23:51:53 GMT
x-content-type-options: nosniff
age: 550670
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 71424
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 15:49:10 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 21 Oct 2022 23:51:53 GMT

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4604 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 27 Oct 2021 14:26:02 GMT
expires: Thu, 27 Oct 2022 14:26:02 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 66220
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 111ms
111ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-9mzq
alt-svc: clear

GET
H2 200 w_480_00005.ts Show response
video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/ 480 KB
480 KB 18ms
18ms XHR
video/mp2t 63.250.56.79
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn6/video/users/hls/30760/video_60bde16905eb1927747393/vid6176b5d6a4b40398963132.mp4/w_480_00005.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 63.250.56.79 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash: bacee7a06288a514de5859d2d498a7c6828a9323fe8eb6b664ce0a9e2c2fc29a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
last-modified: Mon, 25 Oct 2021 13:50:41 GMT
server: Tengine
etag: "6176b631-77eec"
content-type: video/mp2t
access-control-allow-origin: *
expires: Thu, 11 Nov 2021 08:49:42 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 491244
x-proxy-cache: HIT, HIT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
56 B 43ms
42ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021102501&jk=4479724155496031&bg=!lpWlldHNAAbUs_yW1LM7ACkAdvg8Wla5nQCHglF--bkojDEgXT6lTJxUMrIGBOaB1ipHQz91OmPzpAIAAABkUgAAABxoAQeZAqFv56oElA9NzwXODDroAQHY85tn4BHlbujRIf5OZ1cUY35e3HFKIM7jPyM69HUCO6Gxf_h8zfn_I4vo4uMri_f05YgB03a1_OGmDu08yvPuWV8G8hVGHpmyo54itDjEYLEiTtmTBWrcyyPA9yT6keBaq-yVRsthiffhss8Phkf6G0biBS_3FOM5yodTP0XVcXLcI6kQYX9BJPKYrWGWghLMYF6wrZpyPKsMbSz0b0X-IvoB2cRNg-fljaQ3az2LjEOqckImb5nJrGUxXXLu5uytabFd5qV1JPmDqI8PP5zDJYoTWW-TykOySjk31s72Dd4NzR_mil2mtMj7C172eZ-jZyL2QqoczJRkbjw-0xv-gUO5X0QlCsCwCwkxsP_feKS5pVIySit3l26O1YyMf0AStBZRhIGpJckpRCFgKehDhZ5Y1j-jZ0oH8IPGB6J1fI6c6FOwg0NKfgaJBk0COAeYp75TS-kiZbVzUFtwCwjafCETOCY7sI4SS-oM8SHmRDMrZ2xsB6isAIjmJS5YWxEwKvSvkYQiW2vvoE1o7Jo0vLm_SCbWDdACGI2wqCH_geoQ2xmTb78GDdTo5Xirpcx4wA4Q5oXvtbar7SU7-KdsSw72_MV1qj1gSiT5B0_7TJ1d_ROZ10UfbV2CH8M2J1s4_cF6Xo4oLm5pTeiNXcflDZRDmxhqs9GbMO4gKTLee10e_zUKNG3__U6PMaft-aPTIHr9LL3PX-soSgFYL_xPXVQcM_evRoaZZuvRHq5kgyPeRUoBs0w81hpj5xUbC7bMO_48eKrd35wjXvFwKlh8sw-bS3ifxa6qLrQ0OLkRXJ3BBDNUo1u6CS3YEi1iS3_6qqrw32HYzcfWlOkWuc09A3bHlV4gvrR-lMlUJ3T3BA7r

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

js Show response
ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/ Frame 3C3B
Redirect Chain

https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=ac91b8520339c86785e3c7e6de6134dfcd9cbe098723ae610c7a8f26dc4dbb00&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F06069d83da0546...
https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=ac91b8520339c86785e3c7e6de6134dfcd9cbe098723ae610c7a8f26dc4dbb00&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F06069d83da0546...
https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/js?tpid=48&tpuid=fe72e03d8a6c8c18e4b929453222d05e

44 B
587 B

24ms
22ms

Script
text/javascript

54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/js?tpid=48&tpuid=fe72e03d8a6c8c18e4b929453222d05e
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: d1e65f91a23ecf8050786404e83f4d09ab5533517ce4216b93e13ac64f47af1a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
p3p: CP=NOI PSA OUR
content-length: 44
content-type: text/javascript

Redirect headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: nginx
Vary: Accept
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://ih.adscale.de/sium/06069d83da0546749c05909eae9e0661/1635410982298/0/js?tpid=48&tpuid=fe72e03d8a6c8c18e4b929453222d05e
Connection: close
Content-Type: text/plain; charset=utf-8
Content-Length: 147

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DC39
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1

43 B
1 KB

16ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJKm1AIQlZHVAhik0bW3ATAB&v=APEucNWKhs2hvc7QeUUB47LjPV0AqOLU5tEaskSPN1CNf59hB3pfugOtJkIASp19pxKz-x3TiSlRCUa6FiFh_29kWIIe57Nalr_ImnVsvCe7CtP0q2QWjpRHVkqQFleuWJHxnaQacaleT7mosRR3hXSydDrJ_VLxCDZ8dnN15JO90foQP7ri6NI
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:42 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DC39
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YXpkJTzVeRb.zY8hHFdTTwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1&google_hm=2

43 B
1 KB

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJKm1AIQlZHVAhik0bW3ATAB&v=APEucNWKhs2hvc7QeUUB47LjPV0AqOLU5tEaskSPN1CNf59hB3pfugOtJkIASp19pxKz-x3TiSlRCUa6FiFh_29kWIIe57Nalr_ImnVsvCe7CtP0q2QWjpRHVkqQFleuWJHxnaQacaleT7mosRR3hXSydDrJ_VLxCDZ8dnN15JO90foQP7ri6NI
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:42 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame DC39
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENfWGfSMzstXMa2iGhbDKuE&google_cver=1

43 B
1003 B

11ms
11ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENfWGfSMzstXMa2iGhbDKuE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJKm1AIQlZHVAhik0bW3ATAB&v=APEucNWKhs2hvc7QeUUB47LjPV0AqOLU5tEaskSPN1CNf59hB3pfugOtJkIASp19pxKz-x3TiSlRCUa6FiFh_29kWIIe57Nalr_ImnVsvCe7CtP0q2QWjpRHVkqQFleuWJHxnaQacaleT7mosRR3hXSydDrJ_VLxCDZ8dnN15JO90foQP7ri6NI

Protocol

HTTP/1.1

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 76de1ea8-3347-425a-b883-e59a2442ad90
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENfWGfSMzstXMa2iGhbDKuE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC39
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjk4MzUzMzg5MjcwNjY1ODM4

170 B
188 B

18ms
18ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjk4MzUzMzg5MjcwNjY1ODM4

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b983e1af-0ad9-47dc-9852-4ec7a8103376
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjk4MzUzMzg5MjcwNjY1ODM4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js Show response
pagead2.googlesyndication.com/bg/ Frame 4604 35 KB
13 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad8b12962ae8e7b1e5a90d30d5daf381777909bcc20b06faa9d148b888f6cc8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 08:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89298
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13232
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 08:01:24 GMT

GET
H2 200 container.html Show response
e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 0C73 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 28 Oct 2021 08:49:42 GMT
expires: Fri, 28 Oct 2022 08:49:42 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
DATA 200
OK truncated
/ Frame F6CD 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4d1c9ad8eb1580ea242f20cd2803f019e8db3b2aa8d1f626ec7ccc66153fe416

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
109 B 54ms
54ms XHR
text/plain 18.193.159.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.193.159.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-193-159-101.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Thu, 28 Oct 2021 08:49:42 GMT
access-control-allow-credentials: true
vary: Origin

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 20 KB
11 KB 166ms
166ms XHR
application/json 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

48ff1972b3e444629d6de95c2c965f9ca04a49aafe03b90be1d0eb3c2f92b136

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 28 Oct 2021 08:49:43 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4874de8d-3784-4a4f-abe2-d35f83066c80
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://femme4.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 14 KB
8 KB 122ms
98ms XHR
application/json 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.15.0
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: 3cf2aad0082b3f73412dbad63e0d0a3f3aae219aa3e20db4de4aaa1b240fd12e

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://femme4.com
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
562 B 77ms
76ms XHR
application/json 185.86.137.113
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.113 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 3%3b17%3b143
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://femme4.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
114 B 312ms
312ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Thu, 28 Oct 2021 08:49:42 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 221
vary: origin, Accept-Encoding

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
68 B 109ms
108ms XHR
text/html 34.107.161.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://femme4.com
x-cloud-trace-context: cfbc24a733f562498e49645512db013a
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
158 B 105ms
105ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=aYHEBY2cyr64kvaKjGFx_2
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 147f86e012579620be603a0338f117f7228c17ff32bb824937e937981189926b

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

GET
H2 200 arj Show response
pubwise-d.openx.net/w/1.0/ 171 B
358 B 19ms
19ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pubwise-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Ffemme4.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=f702ec61-16cb-438c-809f-fa0a7e09c057&nocache=1635410982936&pubcid=5f46df80-64d4-4b25-9536-60b6119c0fc3&schain=1.0%2C1!pubwise.io%2C6758a5%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%2C320x50&divids=femm_leaderboard&aucs=&auid=545648434
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 85aab4ebc12bb3542c0ee2910b66643b5b34730540c04806d5160d46d627dc4a

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
server: OXGW/16.217.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://femme4.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 162
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 116ms
115ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-k7hr
alt-svc: clear

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 17ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 17ms
17ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
10 KB 326ms
326ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4479724155496031&correlator=645065341662307&output=ldjh&impl=fif&eid=31063280%2C31063282%2C31061690%2C31063140&vrg=2021102501&ptt=17&sc=1&sfv=1-0-38&ecs=20211028&iu_parts=21700304385%3A22564129828%2Cfemme4%2Cfemm_sidebar_1&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250%7C300x600%7C160x600&fluid=height&prev_scp=hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.01%26hb_adid%3D615d4feec0f3539%26hb_bidder%3Dappnexus&eri=5&cookie=ID%3D088639ec3b077111%3AT%3D1635410982%3AS%3DALNI_MbBMRxdmdAocyfvim_5kbv-YftOIw&cdm=femme4.com&bc=31&abxe=1&dt=1635410982946&dlt=1635410981248&idt=429&frm=20&biw=1600&bih=1200&oid=2&adxs=1066&adys=675&adks=647099778&ucis=3&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.femme4.com%2F&loc=https%3A%2F%2Ffemme4.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=308x0&msz=308x0&ga_vid=1451520711.1635410982&ga_sid=1635410982&ga_hid=503897133&ga_fc=true&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

cafe /

Resource Hash

b33aeaf104b2e637c1ff73f73e091560f13646af04a54ac7ab08cb39c4d21087

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 10504
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
sync.quantumdex.io/ Frame B8DD
Redirect Chain

https://ups.analytics.yahoo.com/ups/58424/occ
https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-IE8RuJdE2uE9paprNActl3xZsjh5yOqU4U6tkzo-~A

43 B
129 B

153ms
153ms

Image
image/gif

2606:4700:10::6816:397e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-IE8RuJdE2uE9paprNActl3xZsjh5yOqU4U6tkzo-~A
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::6816:397e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6a52e993ac7d698f-FRA
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-IE8RuJdE2uE9paprNActl3xZsjh5yOqU4U6tkzo-~A
Connection: keep-alive
Content-Length: 0

GET
H2

200

setuid
sync.quantumdex.io/ Frame B8DD
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3D%5BRX_UUID%5D
https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003&rndcb=4917342553
https://x.bidswitch.net/ul_cb/sync?ssp=adconductor&user_id=RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003&rndcb=4917342553
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627&google_hm=YTliMjlhZDYtNjFmZi00ZGMwLWE2YjYtYzlmY2U4MDky...
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESENATP3DobcwEeDtLtH-AUzw&google_cver=1&ssp=adconductor&bsw_param=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627
https://sync.1rx.io/usersync/bidswitch/a9b29ad6-61ff-4dc0-a6b6-c9fce8092627?gdpr=&gdpr_consent=
https://sync.targeting.unrulymedia.com/csync/RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003?redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3DRX-0b61018e-a540-437d-9668-e7f3ed0...
https://sync.quantumdex.io/setuid?bidder=unruly&uid=RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003

43 B
95 B

145ms
145ms

Image
image/gif

2606:4700:10::6816:397e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=unruly&uid=RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::6816:397e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6a52e994ef1c698f-FRA
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=unruly&uid=RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003
date: Thu, 28 Oct 2021 08:49:43 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX0b61018ea540437d9668e7f3ed0277b8003
content-type: text/html

GET
H/1.1 200
OK us
sync.go.sonobi.com/ Frame B8DD 0
478 B 23ms
22ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsonobi%26uid%3D%5BUID%5D

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

setuid
sync.quantumdex.io/ Frame B8DD
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dappnexus%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=appnexus&uid=298353389270665838

43 B
95 B

162ms
162ms

Image
image/gif

2606:4700:10::6816:397e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=298353389270665838
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::6816:397e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6a52e9940d2b698f-FRA
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: ba1de4cd-b58f-4531-b49f-a14a85a224c5
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=298353389270665838
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

setuid
sync.quantumdex.io/ Frame B8DD
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Danswermedia%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=answermedia&uid=298353389270665838

43 B
95 B

145ms
145ms

Image
image/gif

2606:4700:10::6816:397e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=answermedia&uid=298353389270665838
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::6816:397e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6a52e993ed0e698f-FRA
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 885b056a-5d28-4100-95fc-9e60d155a1c7
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://sync.quantumdex.io/setuid?bidder=answermedia&uid=298353389270665838
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

1.gif
id5-sync.com/c/495/0/0/ Frame B8DD
Redirect Chain

https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dinmobi%26uid%3D%7BID5UID%7D
https://id5-sync.com/c/495/0/0/1.gif?gdpr=1&gdpr_consent=

43 B
1 KB

20ms
20ms

Image
image/gif

54.36.109.183
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/c/495/0/0/1.gif?gdpr=1&gdpr_consent=

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning

Protocol

HTTP/1.1

Server

54.36.109.183 , Germany, ASN16276 (OVH, FR),

Reverse DNS

p08.id5-sync.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Thu, 28 Oct 2021 08:49:33 GMT
Transfer-Encoding: chunked
Content-Type: image/gif;charset=UTF-8
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
P3P: CP="CAO PSA OUR"

Redirect headers

Location: https://id5-sync.com/c/495/0/0/1.gif?gdpr=1&gdpr_consent=
Date: Thu, 28 Oct 2021 08:49:33 GMT
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
P3P: CP="CAO PSA OUR"

GET
H2

200

setuid
sync.quantumdex.io/ Frame B8DD
Redirect Chain

https://match.sharethrough.com/FGMrCMMc/v1?redirectUri=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsharethrough%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=sharethrough&uid=5849140e-a701-4418-82a2-9bce05253f57

43 B
95 B

151ms
151ms

Image
image/gif

2606:4700:10::6816:397e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=sharethrough&uid=5849140e-a701-4418-82a2-9bce05253f57
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Server: 2606:4700:10::6816:397e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6a52e9940d2d698f-FRA
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=sharethrough&uid=5849140e-a701-4418-82a2-9bce05253f57
date: Thu, 28 Oct 2021 08:49:43 GMT
content-length: 0

GET
H2 200 um
sync.e-planning.net/ Frame B8DD 42 B
103 B 23ms
21ms Image
image/gif 46.249.52.249
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.e-planning.net/um?dc=bcf310d1654d268f&iss=1&uid=92ef469c-b03c-44aa-8283-1898805706c8
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.249.52.249 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:42 GMT
server: openresty
content-type: image/gif

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame EA35 2 KB
3 KB 23ms
22ms Document
text/html 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: df0a32d7087d9541f903487571604c4bca78826309ade884068438ef4b6bb358

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 73|46|206|88|40|221|152|81
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Content-Length: 1631
Expires: Thu, 28 Oct 2021 08:49:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:42 GMT
Connection: keep-alive

GET
H/1.1 200
OK uc.html Show response
sync.go.sonobi.com/ Frame 3863 43 B
555 B 36ms
12ms Document
text/html 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://sync.go.sonobi.com/uc.html?pubid=4d443a3ea2

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

bcdf010ba3dc61605c33de9b33e7e76dbc3bb4326dcec49f33970345e517fb25

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/

Response headers

Date: Thu, 28 Oct 2021 08:49:42 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, no-store, private
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Tcn: Choice
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
X-Xss-Protection: 0
Content-Encoding: gzip
Server: sonobi-go

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame F02A 2 KB
823 B 22ms
22ms Document
text/html 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=2bb78272a859ca6

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/e-planning

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D506 624 B
340 B 19ms
19ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CI2fnwEQxLOfARjjm723ATAB&v=APEucNXe7CXFBUjLhisk5KYvsb-dldvS1ywc9ocgGv_cmMEhc80r5PzkLsTZu74uiLsDHaicSNV1f7V2P3ur4uhlwJHi5sVNBc1F2A7cSW2bVycP2ZSOnecrp9ZpzBb8KECR8RRb2WrW0VxJTVvvkEEUmDGAWxAaUtajfW0E3qtADyIqtEZVsws

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 28 Oct 2021 08:49:42 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0C73 74 KB
29 KB 53ms
51ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D1nAhvHrkMPa1b620LqLa57EzTEJ4x0Wg2Id25RCfNtgDxBleEkqNy3TRRBunODyu7-Eewz_uchc1N9qfKpyp5IGzhpSW-376DS9W7ORcoEDiPJ6z8tngwJqT4I_Ngze9eSdkSbinIH2jE5eGbPYLrEyzDyg&dbm_d=AKAmf-B1RNQQ5nZKAk8MjMGnMjSaOgxPTKktYSGA3l61DRvuxlWOidc_kkQhCj3KK5yMJnkhAUSACskA4APlTaN7NXiewLQYKxruuF2Il92SvdXuq3MYPLhV8hB96Y8A5IDUcCVpQhFQ_m9KouxAXrFrM8BpwW3wdbs-ARQ-xM7ZJx8q9Cch0fkVRM0NsOUZXQH_2Uenfa6yQb4Pz1qdEZN_WfQD0L9h5drPAgam1r4IsBihzeMdBJhvW5VWnKgiOcqFNW-8KdCW6YnICHbr-QWciq-LRAlyBBPmqWxYd0XDVEsrzpHVhguik1G2tRp9wXlzBvWMtXNb5YQdd0M7_-W_D_MxbMTA8gBLNq0v0vLwAyMohe0s8HUucARxsIaKK5pSWNLBdSLpTlu1TjUlWao-HsLe9_dpKSL98DVP8AqZo5ynlEMrTcWs9b1vZ9bkafOIh5NKaMbgKwIF2TNJptgs2fbtubpz1y6jJgiFKNVyZoUtnkAfZFmy7gnrazrup1IN7L31mGmCuODeRHgv2fpU9ynt-eGQR_LxmjUd0Qyaxljgp4_T_kIWKG07TTWYNsZQWYrMee4IjmICa_IZmNskzBNjX4TOFLcTbiscW2Ii8blmNRQ-ugj0n_V8jrpLrh0V4rY3yDp-fs_39BnpWkf4cUDcD-EpWXIoJbJdCJ-_IxCsaxsBR6JQtsyhvbfsp6-rnBlllOCX7FF8JOGilNU7z3Hl5uDIWAvnAwa6GoatRXGXVgJqLl3bH-0ok5rPGx8YESi5wM3Cs6Dl-j2mjOjjHV9GhgtOhwhzOiaiEtvVsnPgM_EnI76ABU8sFyMYt1C9lXvKrKeECoC5KGEGJFkXf6H-OXiQjB5oN1QldYPigglZZHDV-XIYNDAhTq_Z5ykxvgwAXkj_iJleoCwUGA_oVzZBUtOxUPJ6EFsBvLGLeHDnIs6MMrx29KZg_f2FwFQTd3xtKR7etXkZBVp2sa9U79frjHsmygGHwLYzFrhUJlGyaXBj1ISDW1dadBqHIwvhp7sx-TTBywBvofU_EM5pr6JI9DRVCwxOJJT4iiSYNQ6parNn4MKrtGBP5LJ0xIu1F-p10C20v6C9Jlj-A6smzam9fBxsx2-SURyuR8c4NTwlTYtnpcFja_wC6alzrpXpW0V98c-ESvrgHTTD6SU8CLgZaQ3HTb0_k6fEjcJ-DnG-24mFaJ3NddequPYzaeXmSgKn0kpQHKFCN616eMmQ1Tza53P4xBSpjFeZMnf8ZZZsW5V8csZZ3-DjZT-aIa9_BYxw-5fout74PWecHhGTInY9cxzUBtDSRxjSFydIT7KV8vuZsf2lPz6qwaJPRCz_0YcsmKX0c-u3F7WvoI6z83oEiRXuJ8etA5j2Z2mnf5jSMFAsuDEksK25xTNJd5Obmg1evjX2FUNezH08Fc2f-qhrerDC_I7U2a1spzYWpwcTsG0DFNQUDwEN0fue8GcsAQ_zWoEr_phcsuIuDmP_aPT3Fn7I2TcmTEEaQj-V85BOpKM9vPd0F_BmTy02qjJsdNjIdBexuGcgfw2Vcz-UJQ2wHJQAlmGq6H0kgMin_kysBZdmjfKZMsPKDVoyylUDbdfIIXrx_ZxUbm0nNguCzcxSxLXh7Y3F-WqNPVClYAqaEH5d-K-R_bpaAsnb2pJFGUsdg2x3OxiqOmZH3f9gvNjJmMnLa-bGSMSHg0qbZDipga-EUl8gHnjSl-Vb9JT9P-Hjt2kqKI7056l8kBbA2xMJN-HKux2phKQykHDNAnpODeujhPWCZVpZH7yBRc9NCu010VDjr1Gc2Joyxujx1zXLpryH7AZcNIeU7SMcGRkM8XWiz8gHCtW5TWx3LmcROv4v5L92E1YdMQfWXkZxfkh-ezO8odj8C28lvozF9k2H6arrT6lomZQaJWiGReFDDHUUhkyn8xlc7Vp5JVpecH8Ot0yNr6QwvYd5nh_sI8rEJ9w_W3mpTLpHz6wKhgL2FFhXGFxcYAKgnSHPqRkhSHqHkLCB79tzUII_i4hYUDegGy2iXTmFDlYPR21l3DyTgazu39Ng0gchtoUrWSGMMh4wvYm-FtFXsiNPt14u5MZLT5gpJWrkHr_hvjxImMmRwUDcUEt0FUR6V6k_zsNr8I8vAPrwYigFt2SSWrLFwPCjnMdammOYLkcza4rcJRb55-w8kncr_M_6Jx1mKd0VKEHnyNiik7c_Di25x_rc7qaSZYPnzJRMpITaZ7AGBHfLovx7ObmrBFCbbN3SJto0Cy128dkzF-o8jDf7qiHyYJgmmR-Gl2Xebxt7ml8yytWs9TpRSVV-KWUI43lKsWmuBykl310Vmuit-c1JFuRqWIE8egHdzFv281SBlsilP5mdVOsJu60awX7oPv7ZRlnFWytI1H0PuQR_em0KgjKNPE9rnqz6ZBIQWb2E1dXolnoGiuntQakVmcJ5lPmKU64NvZvH0jLl4GLeQIANNVg-IRG0eo2GvbwxWf8lStQIn4_gcM7hrtdNQt1nNBfodGt8FutShtyx1wtW_SGQU0cyx8ux64jsCx7UIFQqLIj_ZDJMA1H-Qv7D-XObINX-7sljj5X3qnplePpxW_RL7a-WXRvDDepzlMT4ZCQWbyKGCIZQJ1S8a1LfvsQ5fYX19NjAfCT6zTGIARcSktIawQTCBj-rRrjk-IW3gLTWMbqfFhn6fg5L0mD7p_mTOrZtRK_xOpo3sWkRXgJNfkeFu9EpXrnyqMLAu0GQMng7iq1wl9WPHNkQ_-eO3lO6EbwPDxJmNtxBT0e4EXLyKhhJYH3Wn4VdnL6fLfOD43nSGf9yZBXtGEC0htNokydoJM3I_dDUaX40ag7NceM1VFJsLueeQWrEXwteKAoqp9oD21pcgIhjT3rjAIED5XiM1E2dvpSRPpM938uwKd4ezRNvf_o-NWRi1A_6cNDkFqqlhm-xPFzFv0iEy1m5-oq705vDP0WZvYoolclJ1CjTZCyQPkRAnmNqTLV1exHIDjkob3nYM8GIZpFZZP9Avmp7NmOKQpJ7nYnvgvqy6Q&cid=CAASEuRo_J19rQxaNRdhLInMsOcXpQ&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac1c1c6dde564f1522ea6d57cedfc689f5fba1cda868ddd2e9c8b95d661fe77c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29595
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0C73 42 B
107 B 42ms
40ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BQebhfWcPrFvTesFPVhW05lab3jR1X6eDOc0Z3_8sfu_bdC1Nt5i1YaR71GQbHkJeGx1LHZC2q7OzoMjQ_dBl3B7-no_XXmZgK6XL-rHb5hZzl9tM

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 0C73 3 KB
1 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/window_focus_fy2019.js

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:46:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 183
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:46:39 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0C73 120 KB
37 KB 316ms
15ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635161763799786"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 28 Oct 2021 08:49:43 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 0C73 14 KB
6 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:46:13 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 0C73 0
0 17ms
16ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQrWm3Om-ZU9RbJ5Y05k879Kg9s4pKm4jjREktXzIDhAilDcwaH6BYDq8uogzJCx1Tpn74klLSHUfRjqcd64iM3CVsKxg
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

POST
H2 200 sium Show response
ih.adscale.de/ Frame 3C3B 0
190 B 14ms
13ms XHR
application/json 54.93.80.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/sium
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/match.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.80.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-80-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ih.adscale.de
date: Thu, 28 Oct 2021 08:49:43 GMT
access-control-allow-credentials: true
access-control-allow-headers: x-openrtb-version
content-length: 0
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json

GET
H2 200 YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame EA35 43 B
869 B 113ms
36ms Image
image/gif 2a05:d018:d29:3601:b508:a921:ac6e:d806
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB?gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3601:b508:a921:ac6e:d806 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H/1.1 400
Request failed due to privacy signals getuid
secure.adnxs.com/ Frame EA35 0
0 13ms
13ms Image
text/html 185.33.221.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.33.221.87 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H/1.1 204
No Content sync
ups.analytics.yahoo.com/ups/55940/ Frame EA35 0
234 B 14ms
13ms Image
text/plain 18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.138 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: ATS/7.1.2.138
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 ZMAwryCI
sync-tm.everesttech.net/upi/pid/ Frame EA35 85 B
259 B 101ms
98ms Image
image/png 151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1635410983.099129,VS0,VE92
x-served-by: cache-fra19120-FRA
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-type: image/png
content-length: 85
x-cache-hits: 0

GET
H2 200 tpid=YXpkJTzVeRb.zY8hHFdTTwAA%261119
bcp.crwdcntrl.net/map/c=6725/tp=INDX/ Frame EA35 49 B
264 B 37ms
34ms Image
image/gif 52.209.129.133
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=6725/tp=INDX/tpid=YXpkJTzVeRb.zY8hHFdTTwAA%261119?gdpr_consent=&us_privacy=&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.129.133 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-129-133.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.8.193
content-type: image/gif
content-length: 49
expires: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame EA35
Redirect Chain

https://sync.extend.tv/r.gif?exchange=index
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=c605e388-6f12-41cc-911a-ff6afcc2ea77

43 B
1 KB

18ms
18ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=c605e388-6f12-41cc-911a-ff6afcc2ea77
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:43 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
Access-Control-Allow-Origin: *
Content-Type: text/html; charset=utf-8
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=c605e388-6f12-41cc-911a-ff6afcc2ea77
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 132
Expires: Tue, 29 May 1984 15:00:00 GMT

GET p-Z8PuJEk6U7Hyq.gif
pixel.quantserve.com/pixel/ Frame EA35 0
0

GET
H2 200 setuid
sync.quantumdex.io/ Frame EA35 43 B
95 B 291ms
289ms Image
image/gif 2606:4700:10::6816:397e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=ix&uid=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:397e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6a52e9945e1e698f-FRA
content-length: 43
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D506
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1

43 B
1 KB

45ms
44ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI2fnwEQxLOfARjjm723ATAB&v=APEucNXe7CXFBUjLhisk5KYvsb-dldvS1ywc9ocgGv_cmMEhc80r5PzkLsTZu74uiLsDHaicSNV1f7V2P3ur4uhlwJHi5sVNBc1F2A7cSW2bVycP2ZSOnecrp9ZpzBb8KECR8RRb2WrW0VxJTVvvkEEUmDGAWxAaUtajfW0E3qtADyIqtEZVsws
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:43 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D506
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YXpkJTzVeRb.zY8hHFdTTwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1&google_hm=2

43 B
1 KB

26ms
25ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI2fnwEQxLOfARjjm723ATAB&v=APEucNXe7CXFBUjLhisk5KYvsb-dldvS1ywc9ocgGv_cmMEhc80r5PzkLsTZu74uiLsDHaicSNV1f7V2P3ur4uhlwJHi5sVNBc1F2A7cSW2bVycP2ZSOnecrp9ZpzBb8KECR8RRb2WrW0VxJTVvvkEEUmDGAWxAaUtajfW0E3qtADyIqtEZVsws
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:43 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame D506
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENfWGfSMzstXMa2iGhbDKuE&google_cver=1

43 B
1003 B

16ms
15ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENfWGfSMzstXMa2iGhbDKuE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI2fnwEQxLOfARjjm723ATAB&v=APEucNXe7CXFBUjLhisk5KYvsb-dldvS1ywc9ocgGv_cmMEhc80r5PzkLsTZu74uiLsDHaicSNV1f7V2P3ur4uhlwJHi5sVNBc1F2A7cSW2bVycP2ZSOnecrp9ZpzBb8KECR8RRb2WrW0VxJTVvvkEEUmDGAWxAaUtajfW0E3qtADyIqtEZVsws

Protocol

HTTP/1.1

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 276751c5-b5b4-44d3-8c4d-311072c7e84e
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENfWGfSMzstXMa2iGhbDKuE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D506
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjk4MzUzMzg5MjcwNjY1ODM4

170 B
188 B

17ms
16ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjk4MzUzMzg5MjcwNjY1ODM4

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: eaccda0c-9326-4e7d-80a9-613874391270
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjk4MzUzMzg5MjcwNjY1ODM4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 0C73 169 KB
59 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Origin: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 02:52:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21435
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Oct 2021 02:52:28 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/ Frame 0C73 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D1nAhvHrkMPa1b620LqLa57EzTEJ4x0Wg2Id25RCfNtgDxBleEkqNy3TRRBunODyu7-Eewz_uchc1N9qfKpyp5IGzhpSW-376DS9W7ORcoEDiPJ6z8tngwJqT4I_Ngze9eSdkSbinIH2jE5eGbPYLrEyzDyg&dbm_d=AKAmf-B1RNQQ5nZKAk8MjMGnMjSaOgxPTKktYSGA3l61DRvuxlWOidc_kkQhCj3KK5yMJnkhAUSACskA4APlTaN7NXiewLQYKxruuF2Il92SvdXuq3MYPLhV8hB96Y8A5IDUcCVpQhFQ_m9KouxAXrFrM8BpwW3wdbs-ARQ-xM7ZJx8q9Cch0fkVRM0NsOUZXQH_2Uenfa6yQb4Pz1qdEZN_WfQD0L9h5drPAgam1r4IsBihzeMdBJhvW5VWnKgiOcqFNW-8KdCW6YnICHbr-QWciq-LRAlyBBPmqWxYd0XDVEsrzpHVhguik1G2tRp9wXlzBvWMtXNb5YQdd0M7_-W_D_MxbMTA8gBLNq0v0vLwAyMohe0s8HUucARxsIaKK5pSWNLBdSLpTlu1TjUlWao-HsLe9_dpKSL98DVP8AqZo5ynlEMrTcWs9b1vZ9bkafOIh5NKaMbgKwIF2TNJptgs2fbtubpz1y6jJgiFKNVyZoUtnkAfZFmy7gnrazrup1IN7L31mGmCuODeRHgv2fpU9ynt-eGQR_LxmjUd0Qyaxljgp4_T_kIWKG07TTWYNsZQWYrMee4IjmICa_IZmNskzBNjX4TOFLcTbiscW2Ii8blmNRQ-ugj0n_V8jrpLrh0V4rY3yDp-fs_39BnpWkf4cUDcD-EpWXIoJbJdCJ-_IxCsaxsBR6JQtsyhvbfsp6-rnBlllOCX7FF8JOGilNU7z3Hl5uDIWAvnAwa6GoatRXGXVgJqLl3bH-0ok5rPGx8YESi5wM3Cs6Dl-j2mjOjjHV9GhgtOhwhzOiaiEtvVsnPgM_EnI76ABU8sFyMYt1C9lXvKrKeECoC5KGEGJFkXf6H-OXiQjB5oN1QldYPigglZZHDV-XIYNDAhTq_Z5ykxvgwAXkj_iJleoCwUGA_oVzZBUtOxUPJ6EFsBvLGLeHDnIs6MMrx29KZg_f2FwFQTd3xtKR7etXkZBVp2sa9U79frjHsmygGHwLYzFrhUJlGyaXBj1ISDW1dadBqHIwvhp7sx-TTBywBvofU_EM5pr6JI9DRVCwxOJJT4iiSYNQ6parNn4MKrtGBP5LJ0xIu1F-p10C20v6C9Jlj-A6smzam9fBxsx2-SURyuR8c4NTwlTYtnpcFja_wC6alzrpXpW0V98c-ESvrgHTTD6SU8CLgZaQ3HTb0_k6fEjcJ-DnG-24mFaJ3NddequPYzaeXmSgKn0kpQHKFCN616eMmQ1Tza53P4xBSpjFeZMnf8ZZZsW5V8csZZ3-DjZT-aIa9_BYxw-5fout74PWecHhGTInY9cxzUBtDSRxjSFydIT7KV8vuZsf2lPz6qwaJPRCz_0YcsmKX0c-u3F7WvoI6z83oEiRXuJ8etA5j2Z2mnf5jSMFAsuDEksK25xTNJd5Obmg1evjX2FUNezH08Fc2f-qhrerDC_I7U2a1spzYWpwcTsG0DFNQUDwEN0fue8GcsAQ_zWoEr_phcsuIuDmP_aPT3Fn7I2TcmTEEaQj-V85BOpKM9vPd0F_BmTy02qjJsdNjIdBexuGcgfw2Vcz-UJQ2wHJQAlmGq6H0kgMin_kysBZdmjfKZMsPKDVoyylUDbdfIIXrx_ZxUbm0nNguCzcxSxLXh7Y3F-WqNPVClYAqaEH5d-K-R_bpaAsnb2pJFGUsdg2x3OxiqOmZH3f9gvNjJmMnLa-bGSMSHg0qbZDipga-EUl8gHnjSl-Vb9JT9P-Hjt2kqKI7056l8kBbA2xMJN-HKux2phKQykHDNAnpODeujhPWCZVpZH7yBRc9NCu010VDjr1Gc2Joyxujx1zXLpryH7AZcNIeU7SMcGRkM8XWiz8gHCtW5TWx3LmcROv4v5L92E1YdMQfWXkZxfkh-ezO8odj8C28lvozF9k2H6arrT6lomZQaJWiGReFDDHUUhkyn8xlc7Vp5JVpecH8Ot0yNr6QwvYd5nh_sI8rEJ9w_W3mpTLpHz6wKhgL2FFhXGFxcYAKgnSHPqRkhSHqHkLCB79tzUII_i4hYUDegGy2iXTmFDlYPR21l3DyTgazu39Ng0gchtoUrWSGMMh4wvYm-FtFXsiNPt14u5MZLT5gpJWrkHr_hvjxImMmRwUDcUEt0FUR6V6k_zsNr8I8vAPrwYigFt2SSWrLFwPCjnMdammOYLkcza4rcJRb55-w8kncr_M_6Jx1mKd0VKEHnyNiik7c_Di25x_rc7qaSZYPnzJRMpITaZ7AGBHfLovx7ObmrBFCbbN3SJto0Cy128dkzF-o8jDf7qiHyYJgmmR-Gl2Xebxt7ml8yytWs9TpRSVV-KWUI43lKsWmuBykl310Vmuit-c1JFuRqWIE8egHdzFv281SBlsilP5mdVOsJu60awX7oPv7ZRlnFWytI1H0PuQR_em0KgjKNPE9rnqz6ZBIQWb2E1dXolnoGiuntQakVmcJ5lPmKU64NvZvH0jLl4GLeQIANNVg-IRG0eo2GvbwxWf8lStQIn4_gcM7hrtdNQt1nNBfodGt8FutShtyx1wtW_SGQU0cyx8ux64jsCx7UIFQqLIj_ZDJMA1H-Qv7D-XObINX-7sljj5X3qnplePpxW_RL7a-WXRvDDepzlMT4ZCQWbyKGCIZQJ1S8a1LfvsQ5fYX19NjAfCT6zTGIARcSktIawQTCBj-rRrjk-IW3gLTWMbqfFhn6fg5L0mD7p_mTOrZtRK_xOpo3sWkRXgJNfkeFu9EpXrnyqMLAu0GQMng7iq1wl9WPHNkQ_-eO3lO6EbwPDxJmNtxBT0e4EXLyKhhJYH3Wn4VdnL6fLfOD43nSGf9yZBXtGEC0htNokydoJM3I_dDUaX40ag7NceM1VFJsLueeQWrEXwteKAoqp9oD21pcgIhjT3rjAIED5XiM1E2dvpSRPpM938uwKd4ezRNvf_o-NWRi1A_6cNDkFqqlhm-xPFzFv0iEy1m5-oq705vDP0WZvYoolclJ1CjTZCyQPkRAnmNqTLV1exHIDjkob3nYM8GIZpFZZP9Avmp7NmOKQpJ7nYnvgvqy6Q&cid=CAASEuRo_J19rQxaNRdhLInMsOcXpQ&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 518
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:41:05 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/ Frame 0C73 23 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f15dc13ebdca8972b7eeb648108b804feb40f890ae25cc14cf5a3b1379726a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:44:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 303
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9298
x-xss-protection: 0
server: cafe
etag: 5575107075035495308
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:44:40 GMT

GET
H2

200

cs&eq_cc=1 Show response
um2.eqads.com/um/ Frame 7907
Redirect Chain

https://um2.eqads.com/um/cs
https://um2.eqads.com/um/cs&eq_cc=1

186 B
370 B

91ms
91ms

Document
text/html

54.208.142.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://um2.eqads.com/um/cs&eq_cc=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.208.142.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-208-142-27.compute-1.amazonaws.com
Software: /
Resource Hash: 61b16281bedde2f2311d4ed3c5546406eb07257d2e993c8f517491c9ec261feb

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-type: text/html; charset=utf-8
content-length: 186
cache-control: no-cache, must-revalidate
expires: Sat, 6 May 1995 12:00:00 GMT
last-modified: Thu, 28 Oct 2021 08:49:43 GMT
pragma: no-cache

Redirect headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-type: text/html; charset=utf-8
content-length: 41
location: /um/cs&eq_cc=1

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 115ms
115ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-2q77
alt-svc: clear

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 3862 156 B
142 B 186ms
186ms XHR
text/xml 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F21734706084%2C22564129828%2Finterpromoteltd&description_url=https%3A%2F%2Ffemme4.com%2F&env=vp&correlator=1130022141717208&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1&unviewed_position_start=1&cust_params=prmsig%3Dmzaqqc&sdkv=h.3.486.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=DE6E02DE-CB87-44AF-8072-88F30F6076FC&eid=420706098&url=https%3A%2F%2Ffemme4.com%2F&dt=1635410983136&cookie=ID%3D088639ec3b077111-22ed15d903cb00c2%3AT%3D1635410982%3AS%3DALNI_Ma7TDohIMQV4SbPsUM0R3792CsT7w&scor=128608220852619&ged=ve4_td1_tt0_pd1_la1000_er29.-2164.182.-1864_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F6CD 0
23 B 57ms
43ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/ Frame 9B25 79 KB
21 KB 15ms
14ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a66fa962c750468513abf4d5ea81388990f78a6d2bd6730ed65c9da65f866379

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 21297
date: Thu, 28 Oct 2021 08:49:43 GMT
expires: Fri, 29 Oct 2021 08:49:43 GMT
cache-control: public, max-age=86400
last-modified: Fri, 15 Oct 2021 12:36:48 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0C73 0
24 B 49ms
49ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstibjxAfPXV_iZsjdGCMazq5AfvSSG4sOkg5EWsWytpJYqQzGTuXhnfd-ViMM_RtyQa4cKjb6-7DgaskiahVBHAhntt6ROGvhPMWp4pojBICelYljO9RR2hnNbT--_vY-SGeOvKplhrzslcssXlC6AR7J34dskmj2jxy0F-YxN7wMQC-22969Mp9DW9WIBoa8m6DbCmKZ-mZOil-JczxVptK_QBtfFC4EIpuPz-0ncemZv64KpLy8tNLhVj6kBwLHk6JEB0oXl5wjPrRmeZBVBQFmBTWrarrZNygWHA_SKCvKNbrMmku2ATnd8omouFeNMUz_8xvxGnvI5qGUkttEspYcVZgYo1ixwCbm1zyrZKe4dvIpT6qROQtYGA1YyH1rlaCv8iYjYwXv_4kuRs4H0kEMaj6gRvGCSDAv1Sy1k89fLqJ7v3X1ZPrd1ienvY7sCnX2z5Zhbn9bWwkL2qgqW_Vmuc7NwSi404QU0WGYNDalEaLSTEJ6ZpyhwtEomZKisNtcP3CPgjvqGZL2k1IRB2slFbsoBYSggf8kGZZUFnvmTWj9nHa6VnMDtnvmN5DHkuHquF9wD0sDpdgVhfIMU9LJCLmi39VqW8tvbBRIEwoNuwK50gYBhJlTzSZWGJZz1UKOtqx69CsN3m1qVuaT-vQGkoa5ShWZ4XHOBpGfaQltJClLAEKM-A1kPQWh8BKfPB_PQauWq599p2sgDBTUl9Or0xfiJdnIk_y0DdpqjH_32mOtzuRRj1iTqXeTKCreD9HuS9PB2oT_Q6kzr2yawrRTzIoZNBNYvGUu3yVbnpKDmiokdAXLWvV6qDucsgJmvlfd54lnODEh64BKiN8dR0dZxyae2n1TgG2C7So61F3O8qWGKlAhGCsCC3vWPLgRAeDt-nSk5ayzPSU-1emhu080cmZrrStr5WYjhSNxhfIelmSEA5cF9ndezd-7gRuwPCjvOEXW7mTzJ-aSbbOkbIc80FMHTOMOz2emvoGdQc25Lv-XbNjSCbJy9RoPjavdK7q1gpYoKfosCi6IVLr9kG8w8aochdBUV5EHdMAql1Ym4pB72-5qlc8uFuD50mY0Y4RM7nZtF8jhfElOUdewsLavzz-aupVxyvz9dnWV8VDhqOimf93q21jqlUEg-sG5I1Q51VnDkX-VihvlMDeK7IPEEVLY4gFnYznIayX6pZUgGnnVnJXlNsQSPWp_5MZcz7BO8&sai=AMfl-YSNc5lqusWHpyrAxLuKLTr_VPhw-ARWTB762r8InrME4KMJug8jiZ-JP5KTAm2osZ_QpaEK4mdi7jkOs8Lvl9tRqVifAwPyRu11LwvL3D2000RDWzBYei8OzDyWOkJk05CMq9lrPfUWLQecW81YVga2weFfUA&sig=Cg0ArKJSzEmAW59d_ZdPEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=70&cbvp=1&cstd=65&cisv=r20211026.12869&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 28 Oct 2021 08:49:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 m
secure-gg.imrworldwide.com/cgi-bin/ Frame 0C73 0
297 B 128ms
33ms Image
text/plain 54.154.229.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gg.imrworldwide.com/cgi-bin/m?ca=nlsn302965&cr=159916113&ce=N376801.279382DBMTP-MONCLER-INTA&pc=316874644&ci=nlsnci1777&am=1&at=view&rt=banner&st=image&gdpr=&gdpr_consent=&r=924697201&C78=G1,DCM&uoo=0
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.229.129 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-154-229-129.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: nginx
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gg.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-length: 0
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0C73 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 14:26:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66222
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 27 Oct 2022 14:26:01 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1C01 1 KB
868 B 6ms
6ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 27 Oct 2021 08:58:57 GMT
expires: Thu, 28 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 85846
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4604 0
56 B 43ms
41ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bsb3fJmR6YfOUCpeF-ga_nIToAQAAAAA4AeAEAg&bg=!sbKlsvbNAAbUs_yW1LM7ACkAdvg8WhB5Oy7HBhuvGBMZvdt4AdQYY2_kQSwK2O5l1FH7U6cOi5aTFAIAAAEmUgAAABhoAQeZAvWzdTxuwmVsLEx88k3I3NWsB1GpFvNlm91aMcLV9wtde49HipUr_F_cpNxEfZRga2aZsgqXPmj3WIPJoGggxdKIYW4BvIsjgmwdhMOEm-4H8No4qzb1hWNQAW3pgziWUqXgSsUI8tnEANHmDQi7beoVg1fdAoSm6TmwMFu1X-O4ddW6CTBzSqv0UdzTI71_-dA3uJllYimghcRKqaybWijv81o2Zv3RqncS8bBKmvo07hwfPPTF1Wp54bkVEEh9nwXn4muMnvdK_OLJo6dP0idbEVplhnl9APeo_2jJIuOfX8L7CUpunt922i1CjL0paSrMDgytRaNwulACGgbSGVtFt9DGSGhIFKg5TbHVkTeCu7PJ5Y_EolX38EnuitA7MC8tz6uKQKhBdTzDyMzUUjS1-yse9zS9_5n7Cz69k_6Qjif3WdBdk1RaLwVd3HzW1kGVzt-3Pui410SIhYkW5ddyOctewcB5lPfZ2-CVBu9T9hiuKu81WchBc7ZjWlfjy8nUO2BgAo_RQMf9vKaZ7Xhkmhxw8zxBpJY0RRaGYvMoZ87stvqsaV6Urhvfs5dL-gZGbXLgw9ERu1c21V58-SKAeMgMwZg1h3Su1OwBPm9ZreIe-W6YHV-EdV3ESEFPGGvvCrvutm4wJHaybrds8ZL-qWm_PWQTu-fU-lSTmZGLsvXUIB_hfzadkI7NOAHkQBAOW2fCVscj3nxR-Rv-_yIflC1rvPuQJnwpdw54eGMXBz0muT_LwYh48pBTBmHI_K21bBtTT6x4WhVUTRCmTYBACIaBu2MsIdFeKvnZX6nYpYVzg9QeX9w00jQd95n5zUo0TqmAa-7ObilWuCZf-J0y8bTa9tOgwI3vn2VvSSu9J-rM2qPeS0JUHgm0X--w39PEg_yE0hlaX7gOw_TF8JO2kGK1fnvmJyA1QvBzCfaICYhaApzWLA0TqmUtLErgUqhcin8AaHFVlkVYzfZkvYm-Rz6WEHcm9x2qNAY8iZPmLJoE5mnA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 9B25 118 KB
40 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 13:34:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69296
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 13:34:47 GMT

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7CA7 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 27 Oct 2021 14:26:02 GMT
expires: Thu, 27 Oct 2022 14:26:02 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 66221
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 115ms
114ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-r2dl
alt-svc: clear

GET /
google2waycm.netmng.com/cm/ Frame 1C01 0
0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 1C01
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEMZecT_CFMHVbY-2BumWpqU&google_cver=1&google_push=AYg5qPKtzx-ZclITzXuEX8n-LG3HbNWhdY4B68ZVG0jh8SJ9uwhwzRDS6NP_sFsVpQlqzdsSArPhxzKah2G-DHmD3gsURzYCRApX
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDIwMjg4NDkxNDYxMDY0NDQ0Nw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMZecT_CFMHVbY-2BumWpqU&google_cver=1

43 B
407 B

57ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMZecT_CFMHVbY-2BumWpqU&google_cver=1
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 -, , ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMZecT_CFMHVbY-2BumWpqU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C01
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEBaxSs0L9AQvaXAT7lZFzfs&google_cver=1&google_push=AYg5qPIsvx9lgzYXI_QHExWvpQ_BZUjw8hs-YdSRVSGCAiAJcZwnpMXnQZZPZ_EjQNcTuxgLekIRmJ8RkQe...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIsvx9lgzYXI_QHExWvpQ_BZUjw8hs-YdSRVSGCAiAJcZwnpMXnQZZPZ_EjQNcTuxgLekIRmJ8RkQe_kxoycv7pbXAZBzBm&google_hm=bwZMPAOkS7e_ADoG9_MSY0g

170 B
188 B

17ms
17ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIsvx9lgzYXI_QHExWvpQ_BZUjw8hs-YdSRVSGCAiAJcZwnpMXnQZZPZ_EjQNcTuxgLekIRmJ8RkQe_kxoycv7pbXAZBzBm&google_hm=bwZMPAOkS7e_ADoG9_MSY0g

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:42 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIsvx9lgzYXI_QHExWvpQ_BZUjw8hs-YdSRVSGCAiAJcZwnpMXnQZZPZ_EjQNcTuxgLekIRmJ8RkQe_kxoycv7pbXAZBzBm&google_hm=bwZMPAOkS7e_ADoG9_MSY0g
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C01
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEFKxIoHMIGHyIz-9LBfPCG4&google_cver=1&google_push=AYg5qPK0j6flOttlmUiG_B0c_-DHgKNmkXLwgv9fLtCEiRALcJ3hd4IwQA3tLAQtaxJIWXpU1XN4uIg-dxTCLV...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDAzNjY4MzIxNzIzODE3MA%3D%3D&google_push=AYg5qPK0j6flOttlmUiG_B0c_-DHgKNmkXLwgv9fLtCEiRALcJ3hd4IwQA3tLAQtaxJIWXpU1XN4uIg-dxTCLVJrIj...

170 B
188 B

18ms
17ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDAzNjY4MzIxNzIzODE3MA%3D%3D&google_push=AYg5qPK0j6flOttlmUiG_B0c_-DHgKNmkXLwgv9fLtCEiRALcJ3hd4IwQA3tLAQtaxJIWXpU1XN4uIg-dxTCLVJrIjjPnvn3ChmD

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDAzNjY4MzIxNzIzODE3MA%3D%3D&google_push=AYg5qPK0j6flOttlmUiG_B0c_-DHgKNmkXLwgv9fLtCEiRALcJ3hd4IwQA3tLAQtaxJIWXpU1XN4uIg-dxTCLVJrIjjPnvn3ChmD
Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C01
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEK...
https://sync.targeting.unrulymedia.com/csync/RX-0b61018e-a540-437d-9668-e7f3ed0277b8-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPK-clfo5vVIk6hkm-qmD...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPK-clfo5vVIk6hkm-qmDC5CdQnCjcTsaO22vkcrn6c15pvvuO_xF3SZNHnncRjOo9yFP8-wquwCOcu21Yi0S7_WKMRLOsN6&google_hm=AwthAY6lQEN9lmjn8-0Cd7g

170 B
188 B

17ms
17ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPK-clfo5vVIk6hkm-qmDC5CdQnCjcTsaO22vkcrn6c15pvvuO_xF3SZNHnncRjOo9yFP8-wquwCOcu21Yi0S7_WKMRLOsN6&google_hm=AwthAY6lQEN9lmjn8-0Cd7g

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPK-clfo5vVIk6hkm-qmDC5CdQnCjcTsaO22vkcrn6c15pvvuO_xF3SZNHnncRjOo9yFP8-wquwCOcu21Yi0S7_WKMRLOsN6&google_hm=AwthAY6lQEN9lmjn8-0Cd7g
date: Thu, 28 Oct 2021 08:49:43 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX0b61018ea540437d9668e7f3ed0277b8003
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C01
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEAOkTXPxbp2OnTu8wIWle2M&google_cver=1&google_push=AYg5qPITT--klxa_pDzuUlukofZoEeUTUmigI7-iSRqMcq1iB70V9Tkf...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEAOkTXPxbp2OnTu8wIWle2M&google_cver=1&google_push=AYg5qPITT--klxa_pDzuUlukofZoEeUTUmigI7-iSRqMcq1iB70V9Tkf...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEAOkTXPxbp2OnTu8wIWle2M&google_cver=1&google_push=AYg5qPITT--klxa_pDzuUlukofZoEeUTUmigI7-iSRqMcq1iB70V9T...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBmZWFlMDk1OS0zN2NiLTExZWMtYWJkYS0wNjcwYjhkNWVhZTY%3D&google_push=AYg5qPITT--klxa_pDzuUlukofZoEeUTUmigI7-iSRqMcq1iB70V9TkfaR4jS-l546...

170 B
188 B

17ms
17ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBmZWFlMDk1OS0zN2NiLTExZWMtYWJkYS0wNjcwYjhkNWVhZTY%3D&google_push=AYg5qPITT--klxa_pDzuUlukofZoEeUTUmigI7-iSRqMcq1iB70V9TkfaR4jS-l5468R6fuzWQQfvJmwFiFjh8y8FEUDWcIchG2E3A

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBmZWFlMDk1OS0zN2NiLTExZWMtYWJkYS0wNjcwYjhkNWVhZTY%3D&google_push=AYg5qPITT--klxa_pDzuUlukofZoEeUTUmigI7-iSRqMcq1iB70V9TkfaR4jS-l5468R6fuzWQQfvJmwFiFjh8y8FEUDWcIchG2E3A
Connection: keep-alive
Content-Length: 0

GET
H2 200 dot.gif
s0.2mdn.net/ Frame 1C01 43 B
135 B 16ms
14ms Image
image/gif 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEJ-dumglntxUhKgUPFNT78c&google_cver=1&google_push=AYg5qPLiXkOzhNDtf9jIsXqfc3LTfM4a6IL7qtT-fuhyYC-Db0jAaVh7J8wxKv56eh-shwQm0ybBxRA5bMsRHNOne5pcciaSR2vUng

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Oct 2021 08:49:43 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1C01 0
12 B 16ms
15ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KCSO1ewOQVtaDoz3pXUT8gVU6hG_Tb8XrIPljYaqyeyyYz9ZnY_Ab0qRQvrANfFyPFNa6C3C8

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 poster.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/ Frame 9B25 8 KB
8 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/poster.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99b72e3e551fb5d9113474f986849906250e992ae922a765e6030c00092e4f90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 18:19:59 GMT
x-content-type-options: nosniff
age: 52184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7916
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 12:36:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 18:19:59 GMT

GET
H2 200 rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js Show response
pagead2.googlesyndication.com/bg/ Frame 7CA7 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad8b12962ae8e7b1e5a90d30d5daf381777909bcc20b06faa9d148b888f6cc8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 08:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89299
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13232
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 08:01:24 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0C73 0
23 B 44ms
44ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstibjxAfPXV_iZsjdGCMazq5AfvSSG4sOkg5EWsWytpJYqQzGTuXhnfd-ViMM_RtyQa4cKjb6-7DgaskiahVBHAhntt6ROGvhPMWp4pojBICelYljO9RR2hnNbT--_vY-SGeOvKplhrzslcssXlC6AR7J34dskmj2jxy0F-YxN7wMQC-22969Mp9DW9WIBoa8m6DbCmKZ-mZOil-JczxVptK_QBtfFC4EIpuPz-0ncemZv64KpLy8tNLhVj6kBwLHk6JEB0oXl5wjPrRmeZBVBQFmBTWrarrZNygWHA_SKCvKNbrMmku2ATnd8omouFeNMUz_8xvxGnvI5qGUkttEspYcVZgYo1ixwCbm1zyrZKe4dvIpT6qROQtYGA1YyH1rlaCv8iYjYwXv_4kuRs4H0kEMaj6gRvGCSDAv1Sy1k89fLqJ7v3X1ZPrd1ienvY7sCnX2z5Zhbn9bWwkL2qgqW_Vmuc7NwSi404QU0WGYNDalEaLSTEJ6ZpyhwtEomZKisNtcP3CPgjvqGZL2k1IRB2slFbsoBYSggf8kGZZUFnvmTWj9nHa6VnMDtnvmN5DHkuHquF9wD0sDpdgVhfIMU9LJCLmi39VqW8tvbBRIEwoNuwK50gYBhJlTzSZWGJZz1UKOtqx69CsN3m1qVuaT-vQGkoa5ShWZ4XHOBpGfaQltJClLAEKM-A1kPQWh8BKfPB_PQauWq599p2sgDBTUl9Or0xfiJdnIk_y0DdpqjH_32mOtzuRRj1iTqXeTKCreD9HuS9PB2oT_Q6kzr2yawrRTzIoZNBNYvGUu3yVbnpKDmiokdAXLWvV6qDucsgJmvlfd54lnODEh64BKiN8dR0dZxyae2n1TgG2C7So61F3O8qWGKlAhGCsCC3vWPLgRAeDt-nSk5ayzPSU-1emhu080cmZrrStr5WYjhSNxhfIelmSEA5cF9ndezd-7gRuwPCjvOEXW7mTzJ-aSbbOkbIc80FMHTOMOz2emvoGdQc25Lv-XbNjSCbJy9RoPjavdK7q1gpYoKfosCi6IVLr9kG8w8aochdBUV5EHdMAql1Ym4pB72-5qlc8uFuD50mY0Y4RM7nZtF8jhfElOUdewsLavzz-aupVxyvz9dnWV8VDhqOimf93q21jqlUEg-sG5I1Q51VnDkX-VihvlMDeK7IPEEVLY4gFnYznIayX6pZUgGnnVnJXlNsQSPWp_5MZcz7BO8&sai=AMfl-YSNc5lqusWHpyrAxLuKLTr_VPhw-ARWTB762r8InrME4KMJug8jiZ-JP5KTAm2osZ_QpaEK4mdi7jkOs8Lvl9tRqVifAwPyRu11LwvL3D2000RDWzBYei8OzDyWOkJk05CMq9lrPfUWLQecW81YVga2weFfUA&sig=Cg0ArKJSzEmAW59d_ZdPEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=141&vt=11&dtpt=71&dett=3&cstd=65&cisv=r20211026.12869&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 17ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 25 KB
11 KB 329ms
329ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4479724155496031&correlator=4475493175185836&output=ldjh&impl=fif&eid=31063280%2C31063282%2C31061690%2C31063140&vrg=2021102501&ptt=17&sc=1&sfv=1-0-38&ecs=20211028&iu_parts=21700304385%3A22564129828%2Cfemme4%2Cfemm_leaderboard&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C970x250%7C970x90%7C728x90&fluid=height&prev_scp=hb_format%3Dbanner%26hb_size%3D970x250%26hb_pb%3D0.04%26hb_adid%3D659698a3de15e14%26hb_bidder%3Dappnexus&eri=5&cookie=ID%3D088639ec3b077111%3AT%3D1635410982%3AS%3DALNI_MbBMRxdmdAocyfvim_5kbv-YftOIw&cdm=femme4.com&bc=31&abxe=1&dt=1635410983267&dlt=1635410981248&idt=429&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=71&adks=2602073323&ucis=4&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.femme4.com%2F&loc=https%3A%2F%2Ffemme4.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x25&msz=1590x0&ga_vid=1451520711.1635410982&ga_sid=1635410982&ga_hid=503897133&ga_fc=true&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8fc305ac5072bcb2a1a9e41561e04863f70ad289bd9cd75a2738782506e0ab4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11367
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CE04 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 28 Oct 2021 08:49:42 GMT
expires: Fri, 28 Oct 2022 08:49:42 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 9B25 6 KB
4 KB 20ms
20ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba012ec3875724e8acb61899651ab29fae76088af2bfac16aa9cdef88bcac7c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4445
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0C73 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41c4baa8a04a2f2f9dada13798d2aa5b72dd48f090967a906931e55e4a92d1b9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 9B25 17 KB
6 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 28 Oct 2021 08:49:43 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame ABAF 624 B
340 B 17ms
17ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnoIxCA2vS7AhikoJG1ATAB&v=APEucNVxjaqlT6XqAxSU_ujdP9ZHNkoqbtzkCURBJHsq5fgNzqM3guzVKwsoUUPK5aYsAI7GmaJudr0A4grYBs0sePSQHaHfROdH0YuDrvzT1-NODECo0bmwm3BzXzQtYGatOJzssTg60rq4mZetw4MtOiv4ill8laLuB8UyknOrgPPKerD-cTU

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 28 Oct 2021 08:49:43 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CE04 12 KB
9 KB 35ms
34ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DmB2PV8RkJ6Cw32jhiOiUU8-oWIG9AmdCAskzxM0Hv4XycImi32lZmBuRY6q2-RhkaEs96eDCIIm2W8L41mo-GknnW_AermLOS9CgSkvp8vgnr29bTkqU_7fQewk-08STRDPfDT4aG53Ig2BWPmzCV6eHbGA&dbm_d=AKAmf-CeCjzz_7UkZzmDWKspAwMYqEoPja3X0Fg0DP95r7ZJxWz49TD8fdGGU-Uc2cDu1MSHx21as3RCRPARzgy5tAw7f32WPFM89PhctuDP1f0u6xi7XdgJ9RSgI4qE1GsSuczM2B5p0RQHN5KkqfV0jXc0bViIE1hNzjQRXf8zDfTjfr-TyoVGQ0wofVesXIvpoQhCLDkv2k1OFYeA9LZDYCONoB14eGDzpqV3p1XZn6II4ix3IY-dB6R9HZ6Ak-pPAqOtZtWCV9tbny2gcuaNZ7dpHLBrBTGMt-SftsFhs-omGYvq-NKgBYTaadRnx6s6_hAYGLprLX7SxQx9FbXGgSHXC6XeZ4juPWN7GziMOYR5zuBTwR1xuMxBoz89dmrERSJN0AMPso-HPQHK_gLBOq8mRWQuL7X6z4WrPJbS2K7rRHnxCWqEaFxWRD4s5ZioGUMirrKT2KeEhKxz80lEaa_47T4kdKyPfpJLBgGabdg9s2Mqj1k1uvtRaawj6V-jGTUvunlbSaMBOGTnDCdDMLE3P1RU-9HI6w2fzuFxrhacbZueV42bPZlf6CrQfjW9tGm7Vw9htTIkM_-0JxTBf6GXvxY_5NCLO3AidD02A1EwK31gX-xqe7sECg0OHSJDDpFg8EC0l0ANIalkRaMmxHwbadWApfI5KlivOcVodV35n7ff7POEohct630D41Al7mu0I0Tz7jVlLDBabirQjCFRyqnJ_sQ1Rlr1djxeSYd0nqWkGrCg3dt9nAKn0y4B1kGuMBIRhP317HdqtYlVtO-FZhROLoT1kmQetnV_mMOYeu8MeeyvUYozM6d2X8H4VEglxI7S5aVHqjESlviYojoHkb9W2J3sa2V14db1R5P6lZvknrbRITaUtWFhQDeQQyht0HoE5z5OAoJOk8TDLPfF1ZaCGixY4-3RUgBhfFLBMNh6jQo4LTeDS1JgkwjUtSyIZZGmEz4TvOOQTMSDXCx_P_8aul88vZ4XzrQKaBIXIiwJypqAnBAkEvFGTdR9-wE7nAB5uF2MGM6XM05tBS9UhivrAB2bzzFA6NYxa-48YCm_eCc5v0TGwrj_1sGvb_Kyb4CuS1eH0XA-WKlUK6RNRfXU3PHGYVWTqaC6mwiGNNHy4ryqF2MRM8LAY3qGbCZvQ0OkFQj6-1RHLY_JQGwCEB6eWVEsjrB7ZwZ56yvaQQjegrrozc4mq4jN8sEduk56HUomXnN8i-MKFY03slBFoOlgLCfi6_CoOpr7Nvlla6c9S-ARAif4zvQgx7U2RmHY0V2fVg-ueT0z5JdVNDaPV0oMD8clf-EsFvRIxJTrpqaj8cCo_JbPaM8e1uXsaZGjvYF6R6wFD0hMhaCVC3bl8_vBw7yfN3eKkC1pK_WiFA_5404-j7zSGBqFHrQ0QWzGTnSzRD4ZjLzkVdT_WfUi3OXHBTY50bzWmuVZF67hvgypfoOCF0vM5wCkaPMt7AASfZ3L0FxPMLRiiRQNi1jJOY3CXGzjixSB0x3E7ccCMVStLPV70iPEcd0nbkVbAXCYG00c4Dl-De7nkqutAR3fQBSdZFUcEr8exAUwJcaGCcR7bKKIthETdEG4-8ZPnQeV-Dx6z_FY-zNOjzmlHfN8g_jA7otmNW3qyzeOi1WQSwbDhUvHy4U8q6YTloOTL65uu5Kca2us0cXVDkxaEjYUvQ1TWg2sOISrhbmEoMW5vDrxYWNbqbtjb5HoeJIJRwOxHzZJf9eH45Hbr2aokMyoHy8w1gayzZoCQQc5HfcXhZ1mYdOB3R5lM2oTWLhZ7Ayj2baID5NyE9_Qt1ArFILMed0Sc5Gm3pDjuX2PZ08Wd3ADFSi-pS7LTJ5TTab70aS7JK8WWlgoaadm3XtiQRcUpB_lPOMCRQyK_T568w135zZG2-B8KHx85NmChCBjJCcxyLeOSHTJtXnxgRuKPrKobih0Ct7Hn3WQBdZ4RASqaeUIS2tGDrKybTWdWJUSvHWhsx9H4rkeCVqd-KSgD10bli9atsi9Uhd9cboJxmGxErKYfU1eS-QTv9Fl86vto4QgP0it0V-dB-OO1_di7y2VZG36O42UreHCWp1CvK0bwlyY7Kacp9-4VKAxzQHjn9QM52aqeoAzyoiTv9iPYHAyYm5gmhd5wfTTjnUImF_M-0woJwsx4KcJ0t16zFZT5Y5OeWO-vpuR6Dmmg8fycd_FMSiGhimFPsKTh46K6JouKwwmTDSOiz-3_2r3x9Rg6RU1uePd78J27VAgG5A7OAHAPVT4dU4sYXsp1XW8vGITeG9gqTocjq9J84JOfGq1SK7q-DLTuswiLEDsOf9HI7vBXlAXKuh5RWwPPZPkOiZP2bj8mc6mz3b-ISRGD1blmB71Ws2sfPfCztaxV0iuelbyAVeRKVwc9A1JUcHDkTTr39ipCS-4h-cn1eUde6hv2x3Ng27-KeRi4GLGXsP5vyavxKtI04FnecFXvv6pvKFpHTFPBYKNSrEM-6ySvRStivgS3elpMWXGVh2n464HGQU07zh2mcv3gDm9tQWXXOnYjfVO3lNwr_679Ar2rS18cIBYHLigqNyY7VV6qj7ot7HeOmSyXMlwXNeKCgu2KCUgjxUkaXnR9uXuoJ5QvbAdlsCoV43iLi1ZTzsb50J3JvI2kX5aLgneoax80FqwhLAAdloIsAI&cid=CAASEuRo5mKbRucpMWiQRJV0A46rXg&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dcc90d05f8c233250fed3a96e99451c32b955e4ceefa87067863f2ce54851bb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8808
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame CE04 42 B
107 B 40ms
38ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cuux6-vpgVWfSTrBTCYX-LmMhCAwZD7XgK3rnFjTkaV0hbW1yFlBSjwk8r6GpASeGpN-OAEhyG6wJYZK2TM1ddrHKtElW6MGqeEBqSB3LrtOzLxl4

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame CE04 57 KB
19 KB 81ms
38ms Script
text/javascript 173.194.76.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNV5Y9BkVn9SIxfhyl0Jz7JywR_aEncUgBRJzqHoxjN9Q7gZ6ig&d=CnkAoCZ_4GqvQQPgWNmosxbTTObBNZk9Xy2Yu3eo6ieu-_IWlbYL5aBZpT2t26hyF0VSc0nqQZOzJWZFBriOyjWSeMVbsFwwpNgV-pL8d3X1WvmFZPhzkPg53ZzmsjgCWGGj8nmVNezFMKcIqCWBx_hZgB0mnv9PA8sbEukRAKAmf-DsG3jG7bozSu37BDfk77gOj0cWtXfQyzsdXyLcPmKh-RUhVR8M3W1h-Wd6NlE184d2bEvYLnEBNVeX-fJOD49lUiL1ENFveOxZTg_M6AaMuNY0ylgp4p0Y-TA_wonO_YaQLlBSNqOry5k1t-OTKapr2wjyiX1q0XIVXfa9uMClR_p05ilEGBwdjkvzbbD5ZpKP_5aDTomazKt4ZOp4bJ7L121mL2_XjIYqzmWfT4aquOdWk9TrAT_OXDoP_5hzh1MyZ-y62G8fHNIjNPvU44KpMqxV43UgqmdTjjGKx6Xek24t8PIWsExAGCVqXfcy9IfocRuVml-UCXmuQfjwNWzGATocPjmuVS7SrLCLz1jfPElEuGqVtYMI45N0NYcEzPGg5XwglfOskFECkfsTO7osGmfVJ1bCaZbQsTPKeub7KGt9wqAkbEQNdU-eRF_h-pLc5MoBBKMAwOJRgyq8hlIeLJM-ecUJsiD8QxYyGF5pabbE7aR1IeVc5phOAYtS4SJtg6krIzST9rMcF8oHb8e1Q1hfcH3NNFtxwdQDlg4SwdokO46TUcVAVkay_E0DdWmGZaU7dE13F0E5zvrzD-yrdJ7mQTBZ4EZPhHvklVboL59-HbLnC0gdx2XuOp6s4b2s5W3yVOWLwa8FEW25Ao8Qj217ZCOJqMmPf0UlypBvpgQF3HIjBU8yge9ebTqUE7VojMuz55idt8By4qsS1P_Q14WhKJ3T1tKFwut17-PWTZ_wlP_pqqOfhiUTgIDnZRupYJ91jYc7xvCMF0npcGJSTGFhDbdt7RbxdsIsFewLzKyt5SVNNoHIrRyTlGA48ZfOQXNgzczJ2qkCx67G9BaKpZ_R8VEGvgwTPOf6hzdx6gBr51DaixXD5o0WW0XVTkS4Xr7-JsGQn-Y0wZfKSxfKbUy8xhJhCOFmllD9McesFYAQnxbQ1Zdwxy-FVvwsoVdh0yOfyMN42TU5tXdseWJj7FBlqlsAzE4MDsNwx7-Hj28l_5UB-HW5hOHam4yFBuLWXKW9-7TvTeKAB4c8Hwdy0rcYXZ8mUWjp1Z8EHJBTrWOt4PFwxHb4kdLFCIA6q2mCYAs9a6AWvmm1nrlba2W7B_oOZEo2gYMAZ16VBRg6L3hV3j1Qx7TTtUkfT2D-YmfUisfvvn1VJN4IREPWXRX7g8dkvo8uIOQd7yQWJL2h2z7cBmCaq3bq6mCJJMT2JK-r_IJsoID3efj_x3wc-kvdtgB-8Si7XCq957Y73xJsefVeS-QYhsZ5wjOEwOu_MCNd-kLktGjzH1UAW8qU33j0cevPNJwiu_IgFNv6a333OBo0nkX-3VtFATW91CdWbFW1MAaatsmgHV_jmif5KidDlPtN5GEQEmPL9IZ6mpkQyl5skwA_o_0X2GTvCdAp-2iYmNbGcFD0Pz5beQUdMDLJF6aelDFMalVGwV-qT9PhqXSk88Ip8F80g9zvDzo4_PXPRKD773TdVJnC2GFe2acfS4gbVdtKJmnVnkElVEMzkf1cW3ItJeXB6TcuZ_RrsjsafMNUhkEWXVDtH0hc6WOoK3-xg4wtfbZA9sToYYt3J7H_uIhuoH5YcT6nWfaVkaOS0KI8BCDjxGSCjdu_jyS6yp-JUbSYUsJVNyRBQkoHut4arBV9AyTdUpXfFN5nS14zgCZIwrihoYYB7iE6gvpowZep4VaS6e7j1TpWNp1KKqvkuMfmNV2fcC0kCwpNs7vbjN5-tCshJa286H1ttS336t09fb91pUj59FYXsSrRgt6mHK9b6AmvYFHW0q1g8VgwlGbByV6LpxU2YYWTQ8Rnv1XqGNGnKR-rVvHjclMvKJIUhr_gd-Yd6dnB_KrzQO65Dh01JCaSWP1mFcv8uO_UzugJG58ig2M4tr7j-8JpmxqbuRoTUw0S0hZueyluuYjOhXGH_es0_xeLeTyqaE7-2QHJzb9-hWOhXCjdgJsWItPHeyB9xG9HA6tqASeRfmhI6KYWSm4V5wWV7GwDbFUBFKsRuptc84CCWu84bKvmEIkT14tS8qZSccC2HaRquHxyFD-vJMNopvBlNG3Wn4daZNeMnIM37rI6lz8URNGpH74NXjfpTUwsbsKiLc1__ZhUEAR05jP7EWBL4fgLfFF-_OoEwaAthOBnrY43vGDDZQtgi5MreMTYteGUXNLtB6uLfKsGga9gMI-kTRRmJgQ_dmVI_eEO5YM1S5c3wsWwbNNKws0DtbqREl9Q5fqdTNzB3-u88RdX-oy2Ddb3-cy-I9iXqX1OQVd96xIjEQ3zb53rBJlzBIp0nZieGFZevgqnA1bP5nhuTPSXHB-qZqchuZ52lufxvFVrGDoeVZhfEq92R_6xWnvrl1ZN0gJNfN_-TT7MgCRpnNdPDCPXAvICQo0FZ5w29FzsxLxKckcmof6NfCQLqECiClRmWFJfvv1ARpTqj-wTjdg7MclQqCLOJuSHD-7FV9nqWiyroKkvB7mWI0EvfCvKJ7tpqXdblVfeX8Qe3lqVwrtf63voL4jO04QpD6qrRAYTJrOHIqmft99m6rfsXk6GwOgb51ZwoTvkyve3EJxPTg6sbTY_A33EpXxAka-0ih8nXo_TSSW-KpomkWdJH11LyioFVEuODNV5aAMIR5mLv4m0SVMUOFaP554fbe_CgJGb5WoLad6Muwwsf2dVzUf2we5cq87sm4ddXpDVj1mg83-xgcTouvS6abng4XAEvLMp9A-qnuxlSNdLfOErCG0yRmvyRRdZZK-tc-kHySwbUFKL0eCMojoom1mFISGia-kbKicLHO6J3lP0UXkQGC6W5mweGbgMiZF4COT5_A-ks2QWNhHvUDQWQV8oleShf-5JrphICxQl-EhPGwE1PiNNDSdBTHMadtmilanA1bBwnd4bsMm8ZS8BWgkAQWY4HBQcypNWa5b6PwhRIKobUTBGyZpNZTfkx9rby3v4Ngi4hseKA4vs-vO5mf2me5x0jY6vvJ86glGbg0Cs10W2AqAGCdnakXwF7wUmBqDycaLOty4aZHr9epC30ztFKRoWCAASEuRo5mKbRucpMWiQRJV0A46rXmAB

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f156.1e100.net

Software

cafe /

Resource Hash

146f10412bc93bb7132569a21e0c3d4e2f2af94836801a9b03c10c07cb936e87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19018
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca Show response
choices.truste.com/ Frame CE04 27 KB
10 KB 35ms
9ms Script
text/javascript 143.204.98.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=2&c=digitas01cont5&w=300&h=600
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.27 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-27.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: b94eb1be9d4a7d51b2b8b17c4cc0667a6358b195cd0baccf88a2133b6553a600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Oct 2021 09:26:29 GMT
content-encoding: gzip
server: nginx
age: 84194
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 6f9ZT9uIA9CxHT_3tgg7DXKiYqUwZKqtKIfENczHjXqy6ryuCywFtw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame CE04 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/window_focus_fy2019.js

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:46:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 184
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:46:39 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CE04 120 KB
37 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635161763799786"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 28 Oct 2021 08:49:43 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame CE04 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:46:13 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame CE04 0
0 14ms
14ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ30GydC4rh4jxMWseqSgsLeMueafArCvmqzixdekJ9stLqsjUygAbE4DVeYXrFkyJTYnthUiF7J2Ty_e6Ly9HA9vh-gw
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 poster.jpg
s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/ Frame 9B25 8 KB
8 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/poster.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99b72e3e551fb5d9113474f986849906250e992ae922a765e6030c00092e4f90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 18:19:59 GMT
x-content-type-options: nosniff
age: 52184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7916
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 12:36:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 18:19:59 GMT

GET
H2 200 soundon.png
s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/ Frame 9B25 4 KB
4 KB 8ms
8ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/soundon.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fefbef456d0bbdd2d5b8bb6afd9b048b4e992256f0929d14f555309508494e4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 01:12:17 GMT
x-content-type-options: nosniff
age: 27446
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4315
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 12:36:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Oct 2021 01:12:17 GMT

GET
H2 200 soundoff.png
s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/ Frame 9B25 4 KB
4 KB 10ms
10ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/soundoff.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a96d4f0941ee39c51a38bb5c6215fb390139d6dda4d21bd4a70d44302d7dea8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 18:19:59 GMT
x-content-type-options: nosniff
age: 52184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4244
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 12:36:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 18:19:59 GMT

GET
H2 200 repeat.png
s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/ Frame 9B25 4 KB
4 KB 9ms
9ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/repeat.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60ff47dd82f8534f9648d87f9a2a19c4bdc9982319e00fafc2c350a5ec6a53c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 04:50:41 GMT
x-content-type-options: nosniff
age: 14342
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4229
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 12:36:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Oct 2021 04:50:41 GMT

GET
H2 200 pausa.png
s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/ Frame 9B25 4 KB
4 KB 9ms
8ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/pausa.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

385a356efa4114b719beed902aba094c8a9ca1a9381d262b598857c23fdd635a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 18:19:59 GMT
x-content-type-options: nosniff
age: 52184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4095
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 12:36:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 18:19:59 GMT

GET
H2 200 play.png
s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/ Frame 9B25 4 KB
4 KB 9ms
9ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/play.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

936047e29bc4ae82f5dd26383d9039abddb5569d5fa4b9f85762628446ba14b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 18:19:59 GMT
x-content-type-options: nosniff
age: 52184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4144
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 12:36:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 18:19:59 GMT

GET
H/1.1

206
Partial Content

file.mp4
r3---sn-4g5ednsk.c.2mdn.net/videoplayback/id/0b78627de525ce51/itag/15/source/doubleclick/ratebypass/yes/mime/video%2Fmp4/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778749441/sparams/acao,expire,id,ip,ipb... Frame 9B25
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/0b78627de525ce51/itag/15/source/doubleclick/ratebypass/yes/mime/video%2Fmp4/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778749441/sparams/id,itag,source,ratebypass,m...
https://r3---sn-4g5ednsk.c.2mdn.net/videoplayback/id/0b78627de525ce51/itag/15/source/doubleclick/ratebypass/yes/mime/video%2Fmp4/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778749441/sparams/acao,expire,i...

818 KB
818 KB

63ms
7ms

Media
video/mp4

2a00:1450:4001:6f::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r3---sn-4g5ednsk.c.2mdn.net/videoplayback/id/0b78627de525ce51/itag/15/source/doubleclick/ratebypass/yes/mime/video%2Fmp4/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778749441/sparams/acao,expire,id,ip,ipbits,itag,mh,mime,mip,mm,mn,ms,mv,mvi,pl,ratebypass,source/signature/357255C6032C64B267E90EBECBAB8220BDA6F824.15861F7EAA4D19CB45085037EC5073424189EECF/key/cms1/cms_redirect/yes/mh/S6/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsk/ms/onc/mt/1635409213/mv/u/mvi/3/pl/48/file/file.mp4

Protocol

HTTP/1.1

Server

2a00:1450:4001:6f::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

1fd01646c733f17c1dc92d443ecbcf0368ea0492e31e32186af140ebce8cda3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Thu, 28 Oct 2021 08:49:43 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 15 Oct 2021 12:29:23 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-837284/837285
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 837285
Expires: Thu, 28 Oct 2021 08:49:43 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r3---sn-4g5ednsk.c.2mdn.net/videoplayback/id/0b78627de525ce51/itag/15/source/doubleclick/ratebypass/yes/mime/video%2Fmp4/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778749441/sparams/acao,expire,id,ip,ipbits,itag,mh,mime,mip,mm,mn,ms,mv,mvi,pl,ratebypass,source/signature/357255C6032C64B267E90EBECBAB8220BDA6F824.15861F7EAA4D19CB45085037EC5073424189EECF/key/cms1/cms_redirect/yes/mh/S6/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsk/ms/onc/mt/1635409213/mv/u/mvi/3/pl/48/file/file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 680
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 prod_studio_01_247_videomodule.js Show response
s0.2mdn.net/879366/ Frame 9B25 13 KB
5 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_247_videomodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78b8b9c06e8648b397191402eb4ca35c9a83400e71f2338c84f2ef1393ef32cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61920661/20211015053648001/index.html?e=69&leftOffset=0&topOffset=0&c=hyOz5ldten&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 14:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66657
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5003
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 14:18:46 GMT

GET
H2 200 rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js Show response
pagead2.googlesyndication.com/bg/ Frame C604 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad8b12962ae8e7b1e5a90d30d5daf381777909bcc20b06faa9d148b888f6cc8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 08:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89299
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13232
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 08:01:24 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame ABAF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1

43 B
1 KB

15ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnoIxCA2vS7AhikoJG1ATAB&v=APEucNVxjaqlT6XqAxSU_ujdP9ZHNkoqbtzkCURBJHsq5fgNzqM3guzVKwsoUUPK5aYsAI7GmaJudr0A4grYBs0sePSQHaHfROdH0YuDrvzT1-NODECo0bmwm3BzXzQtYGatOJzssTg60rq4mZetw4MtOiv4ill8laLuB8UyknOrgPPKerD-cTU
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:43 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame ABAF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YXpkJTzVeRb.zY8hHFdTTwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1&google_hm=2

43 B
1 KB

16ms
16ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnoIxCA2vS7AhikoJG1ATAB&v=APEucNVxjaqlT6XqAxSU_ujdP9ZHNkoqbtzkCURBJHsq5fgNzqM3guzVKwsoUUPK5aYsAI7GmaJudr0A4grYBs0sePSQHaHfROdH0YuDrvzT1-NODECo0bmwm3BzXzQtYGatOJzssTg60rq4mZetw4MtOiv4ill8laLuB8UyknOrgPPKerD-cTU
Protocol: HTTP/1.1
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:43 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKFdgy__RQbngOdEWCCNte4&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame ABAF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENfWGfSMzstXMa2iGhbDKuE&google_cver=1

43 B
1003 B

33ms
32ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENfWGfSMzstXMa2iGhbDKuE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnoIxCA2vS7AhikoJG1ATAB&v=APEucNVxjaqlT6XqAxSU_ujdP9ZHNkoqbtzkCURBJHsq5fgNzqM3guzVKwsoUUPK5aYsAI7GmaJudr0A4grYBs0sePSQHaHfROdH0YuDrvzT1-NODECo0bmwm3BzXzQtYGatOJzssTg60rq4mZetw4MtOiv4ill8laLuB8UyknOrgPPKerD-cTU

Protocol

HTTP/1.1

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 504571db-b545-4b9f-92db-208a756dc53d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENfWGfSMzstXMa2iGhbDKuE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame ABAF
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjk4MzUzMzg5MjcwNjY1ODM4

170 B
188 B

17ms
17ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjk4MzUzMzg5MjcwNjY1ODM4

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: e7df8588-b7e2-4851-bdad-c8ff074c0c28
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mjk4MzUzMzg5MjcwNjY1ODM4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame CE04 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DmB2PV8RkJ6Cw32jhiOiUU8-oWIG9AmdCAskzxM0Hv4XycImi32lZmBuRY6q2-RhkaEs96eDCIIm2W8L41mo-GknnW_AermLOS9CgSkvp8vgnr29bTkqU_7fQewk-08STRDPfDT4aG53Ig2BWPmzCV6eHbGA&dbm_d=AKAmf-CeCjzz_7UkZzmDWKspAwMYqEoPja3X0Fg0DP95r7ZJxWz49TD8fdGGU-Uc2cDu1MSHx21as3RCRPARzgy5tAw7f32WPFM89PhctuDP1f0u6xi7XdgJ9RSgI4qE1GsSuczM2B5p0RQHN5KkqfV0jXc0bViIE1hNzjQRXf8zDfTjfr-TyoVGQ0wofVesXIvpoQhCLDkv2k1OFYeA9LZDYCONoB14eGDzpqV3p1XZn6II4ix3IY-dB6R9HZ6Ak-pPAqOtZtWCV9tbny2gcuaNZ7dpHLBrBTGMt-SftsFhs-omGYvq-NKgBYTaadRnx6s6_hAYGLprLX7SxQx9FbXGgSHXC6XeZ4juPWN7GziMOYR5zuBTwR1xuMxBoz89dmrERSJN0AMPso-HPQHK_gLBOq8mRWQuL7X6z4WrPJbS2K7rRHnxCWqEaFxWRD4s5ZioGUMirrKT2KeEhKxz80lEaa_47T4kdKyPfpJLBgGabdg9s2Mqj1k1uvtRaawj6V-jGTUvunlbSaMBOGTnDCdDMLE3P1RU-9HI6w2fzuFxrhacbZueV42bPZlf6CrQfjW9tGm7Vw9htTIkM_-0JxTBf6GXvxY_5NCLO3AidD02A1EwK31gX-xqe7sECg0OHSJDDpFg8EC0l0ANIalkRaMmxHwbadWApfI5KlivOcVodV35n7ff7POEohct630D41Al7mu0I0Tz7jVlLDBabirQjCFRyqnJ_sQ1Rlr1djxeSYd0nqWkGrCg3dt9nAKn0y4B1kGuMBIRhP317HdqtYlVtO-FZhROLoT1kmQetnV_mMOYeu8MeeyvUYozM6d2X8H4VEglxI7S5aVHqjESlviYojoHkb9W2J3sa2V14db1R5P6lZvknrbRITaUtWFhQDeQQyht0HoE5z5OAoJOk8TDLPfF1ZaCGixY4-3RUgBhfFLBMNh6jQo4LTeDS1JgkwjUtSyIZZGmEz4TvOOQTMSDXCx_P_8aul88vZ4XzrQKaBIXIiwJypqAnBAkEvFGTdR9-wE7nAB5uF2MGM6XM05tBS9UhivrAB2bzzFA6NYxa-48YCm_eCc5v0TGwrj_1sGvb_Kyb4CuS1eH0XA-WKlUK6RNRfXU3PHGYVWTqaC6mwiGNNHy4ryqF2MRM8LAY3qGbCZvQ0OkFQj6-1RHLY_JQGwCEB6eWVEsjrB7ZwZ56yvaQQjegrrozc4mq4jN8sEduk56HUomXnN8i-MKFY03slBFoOlgLCfi6_CoOpr7Nvlla6c9S-ARAif4zvQgx7U2RmHY0V2fVg-ueT0z5JdVNDaPV0oMD8clf-EsFvRIxJTrpqaj8cCo_JbPaM8e1uXsaZGjvYF6R6wFD0hMhaCVC3bl8_vBw7yfN3eKkC1pK_WiFA_5404-j7zSGBqFHrQ0QWzGTnSzRD4ZjLzkVdT_WfUi3OXHBTY50bzWmuVZF67hvgypfoOCF0vM5wCkaPMt7AASfZ3L0FxPMLRiiRQNi1jJOY3CXGzjixSB0x3E7ccCMVStLPV70iPEcd0nbkVbAXCYG00c4Dl-De7nkqutAR3fQBSdZFUcEr8exAUwJcaGCcR7bKKIthETdEG4-8ZPnQeV-Dx6z_FY-zNOjzmlHfN8g_jA7otmNW3qyzeOi1WQSwbDhUvHy4U8q6YTloOTL65uu5Kca2us0cXVDkxaEjYUvQ1TWg2sOISrhbmEoMW5vDrxYWNbqbtjb5HoeJIJRwOxHzZJf9eH45Hbr2aokMyoHy8w1gayzZoCQQc5HfcXhZ1mYdOB3R5lM2oTWLhZ7Ayj2baID5NyE9_Qt1ArFILMed0Sc5Gm3pDjuX2PZ08Wd3ADFSi-pS7LTJ5TTab70aS7JK8WWlgoaadm3XtiQRcUpB_lPOMCRQyK_T568w135zZG2-B8KHx85NmChCBjJCcxyLeOSHTJtXnxgRuKPrKobih0Ct7Hn3WQBdZ4RASqaeUIS2tGDrKybTWdWJUSvHWhsx9H4rkeCVqd-KSgD10bli9atsi9Uhd9cboJxmGxErKYfU1eS-QTv9Fl86vto4QgP0it0V-dB-OO1_di7y2VZG36O42UreHCWp1CvK0bwlyY7Kacp9-4VKAxzQHjn9QM52aqeoAzyoiTv9iPYHAyYm5gmhd5wfTTjnUImF_M-0woJwsx4KcJ0t16zFZT5Y5OeWO-vpuR6Dmmg8fycd_FMSiGhimFPsKTh46K6JouKwwmTDSOiz-3_2r3x9Rg6RU1uePd78J27VAgG5A7OAHAPVT4dU4sYXsp1XW8vGITeG9gqTocjq9J84JOfGq1SK7q-DLTuswiLEDsOf9HI7vBXlAXKuh5RWwPPZPkOiZP2bj8mc6mz3b-ISRGD1blmB71Ws2sfPfCztaxV0iuelbyAVeRKVwc9A1JUcHDkTTr39ipCS-4h-cn1eUde6hv2x3Ng27-KeRi4GLGXsP5vyavxKtI04FnecFXvv6pvKFpHTFPBYKNSrEM-6ySvRStivgS3elpMWXGVh2n464HGQU07zh2mcv3gDm9tQWXXOnYjfVO3lNwr_679Ar2rS18cIBYHLigqNyY7VV6qj7ot7HeOmSyXMlwXNeKCgu2KCUgjxUkaXnR9uXuoJ5QvbAdlsCoV43iLi1ZTzsb50J3JvI2kX5aLgneoax80FqwhLAAdloIsAI&cid=CAASEuRo5mKbRucpMWiQRJV0A46rXg&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 14:26:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66222
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 27 Oct 2022 14:26:01 GMT

GET
H2 200 m7y5t93k
sync-tm.everesttech.net/upi/pid/ Frame A04C 85 B
145 B 96ms
96ms Image
image/png 151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1635410983.421936,VS0,VE89
x-served-by: cache-fra19120-FRA
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-type: image/png
content-length: 85
x-cache-hits: 0

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame A04C
Redirect Chain

https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true
https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UPfeae0959-37cb-11ec-abda-0670b8d5eae6
https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVBmZWFlMDk1OS0zN2NiLTExZWMtYWJkYS0wNjcwYjhkNWVhZTY%3D
https://pixel.advertising.com/ups/57304/sync?uid=CAESEMW9YsRnXxPm4_Nq2t-JYkc&google_cver=1
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMW9YsRnXxPm4_Nq2t-JYkc&google_cver=1&apid=UPfeae0959-37cb-11ec-abda-0670b8d5eae6

0
1 KB

12ms
11ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMW9YsRnXxPm4_Nq2t-JYkc&google_cver=1&apid=UPfeae0959-37cb-11ec-abda-0670b8d5eae6

Protocol

HTTP/1.1

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.138 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: ATS/7.1.2.138
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMW9YsRnXxPm4_Nq2t-JYkc&google_cver=1&apid=UPfeae0959-37cb-11ec-abda-0670b8d5eae6
date: Thu, 28 Oct 2021 08:49:43 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55953/ Frame A04C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://ups.analytics.yahoo.com/ups/55953/sync?uid=885cb34c-bf55-48a9-adcd-4ce806d857bb&_origin=1&gdpr=1&gdpr_consent=

0
234 B

11ms
10ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55953/sync?uid=885cb34c-bf55-48a9-adcd-4ce806d857bb&_origin=1&gdpr=1&gdpr_consent=

Protocol

HTTP/1.1

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.138 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: ATS/7.1.2.138
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ups.analytics.yahoo.com/ups/55953/sync?uid=885cb34c-bf55-48a9-adcd-4ce806d857bb&_origin=1&gdpr=1&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 267

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C2D4 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 27 Oct 2021 14:26:02 GMT
expires: Thu, 27 Oct 2022 14:26:02 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 66221
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame CE04 106 KB
37 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Origin: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 14:26:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66222
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 14:26:01 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211020/r20110914/elements/html/ Frame CE04 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211020/r20110914/elements/html/omrhp.js

Requested by

Host: bid.g.doubleclick.net
URL: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNV5Y9BkVn9SIxfhyl0Jz7JywR_aEncUgBRJzqHoxjN9Q7gZ6ig&d=CnkAoCZ_4GqvQQPgWNmosxbTTObBNZk9Xy2Yu3eo6ieu-_IWlbYL5aBZpT2t26hyF0VSc0nqQZOzJWZFBriOyjWSeMVbsFwwpNgV-pL8d3X1WvmFZPhzkPg53ZzmsjgCWGGj8nmVNezFMKcIqCWBx_hZgB0mnv9PA8sbEukRAKAmf-DsG3jG7bozSu37BDfk77gOj0cWtXfQyzsdXyLcPmKh-RUhVR8M3W1h-Wd6NlE184d2bEvYLnEBNVeX-fJOD49lUiL1ENFveOxZTg_M6AaMuNY0ylgp4p0Y-TA_wonO_YaQLlBSNqOry5k1t-OTKapr2wjyiX1q0XIVXfa9uMClR_p05ilEGBwdjkvzbbD5ZpKP_5aDTomazKt4ZOp4bJ7L121mL2_XjIYqzmWfT4aquOdWk9TrAT_OXDoP_5hzh1MyZ-y62G8fHNIjNPvU44KpMqxV43UgqmdTjjGKx6Xek24t8PIWsExAGCVqXfcy9IfocRuVml-UCXmuQfjwNWzGATocPjmuVS7SrLCLz1jfPElEuGqVtYMI45N0NYcEzPGg5XwglfOskFECkfsTO7osGmfVJ1bCaZbQsTPKeub7KGt9wqAkbEQNdU-eRF_h-pLc5MoBBKMAwOJRgyq8hlIeLJM-ecUJsiD8QxYyGF5pabbE7aR1IeVc5phOAYtS4SJtg6krIzST9rMcF8oHb8e1Q1hfcH3NNFtxwdQDlg4SwdokO46TUcVAVkay_E0DdWmGZaU7dE13F0E5zvrzD-yrdJ7mQTBZ4EZPhHvklVboL59-HbLnC0gdx2XuOp6s4b2s5W3yVOWLwa8FEW25Ao8Qj217ZCOJqMmPf0UlypBvpgQF3HIjBU8yge9ebTqUE7VojMuz55idt8By4qsS1P_Q14WhKJ3T1tKFwut17-PWTZ_wlP_pqqOfhiUTgIDnZRupYJ91jYc7xvCMF0npcGJSTGFhDbdt7RbxdsIsFewLzKyt5SVNNoHIrRyTlGA48ZfOQXNgzczJ2qkCx67G9BaKpZ_R8VEGvgwTPOf6hzdx6gBr51DaixXD5o0WW0XVTkS4Xr7-JsGQn-Y0wZfKSxfKbUy8xhJhCOFmllD9McesFYAQnxbQ1Zdwxy-FVvwsoVdh0yOfyMN42TU5tXdseWJj7FBlqlsAzE4MDsNwx7-Hj28l_5UB-HW5hOHam4yFBuLWXKW9-7TvTeKAB4c8Hwdy0rcYXZ8mUWjp1Z8EHJBTrWOt4PFwxHb4kdLFCIA6q2mCYAs9a6AWvmm1nrlba2W7B_oOZEo2gYMAZ16VBRg6L3hV3j1Qx7TTtUkfT2D-YmfUisfvvn1VJN4IREPWXRX7g8dkvo8uIOQd7yQWJL2h2z7cBmCaq3bq6mCJJMT2JK-r_IJsoID3efj_x3wc-kvdtgB-8Si7XCq957Y73xJsefVeS-QYhsZ5wjOEwOu_MCNd-kLktGjzH1UAW8qU33j0cevPNJwiu_IgFNv6a333OBo0nkX-3VtFATW91CdWbFW1MAaatsmgHV_jmif5KidDlPtN5GEQEmPL9IZ6mpkQyl5skwA_o_0X2GTvCdAp-2iYmNbGcFD0Pz5beQUdMDLJF6aelDFMalVGwV-qT9PhqXSk88Ip8F80g9zvDzo4_PXPRKD773TdVJnC2GFe2acfS4gbVdtKJmnVnkElVEMzkf1cW3ItJeXB6TcuZ_RrsjsafMNUhkEWXVDtH0hc6WOoK3-xg4wtfbZA9sToYYt3J7H_uIhuoH5YcT6nWfaVkaOS0KI8BCDjxGSCjdu_jyS6yp-JUbSYUsJVNyRBQkoHut4arBV9AyTdUpXfFN5nS14zgCZIwrihoYYB7iE6gvpowZep4VaS6e7j1TpWNp1KKqvkuMfmNV2fcC0kCwpNs7vbjN5-tCshJa286H1ttS336t09fb91pUj59FYXsSrRgt6mHK9b6AmvYFHW0q1g8VgwlGbByV6LpxU2YYWTQ8Rnv1XqGNGnKR-rVvHjclMvKJIUhr_gd-Yd6dnB_KrzQO65Dh01JCaSWP1mFcv8uO_UzugJG58ig2M4tr7j-8JpmxqbuRoTUw0S0hZueyluuYjOhXGH_es0_xeLeTyqaE7-2QHJzb9-hWOhXCjdgJsWItPHeyB9xG9HA6tqASeRfmhI6KYWSm4V5wWV7GwDbFUBFKsRuptc84CCWu84bKvmEIkT14tS8qZSccC2HaRquHxyFD-vJMNopvBlNG3Wn4daZNeMnIM37rI6lz8URNGpH74NXjfpTUwsbsKiLc1__ZhUEAR05jP7EWBL4fgLfFF-_OoEwaAthOBnrY43vGDDZQtgi5MreMTYteGUXNLtB6uLfKsGga9gMI-kTRRmJgQ_dmVI_eEO5YM1S5c3wsWwbNNKws0DtbqREl9Q5fqdTNzB3-u88RdX-oy2Ddb3-cy-I9iXqX1OQVd96xIjEQ3zb53rBJlzBIp0nZieGFZevgqnA1bP5nhuTPSXHB-qZqchuZ52lufxvFVrGDoeVZhfEq92R_6xWnvrl1ZN0gJNfN_-TT7MgCRpnNdPDCPXAvICQo0FZ5w29FzsxLxKckcmof6NfCQLqECiClRmWFJfvv1ARpTqj-wTjdg7MclQqCLOJuSHD-7FV9nqWiyroKkvB7mWI0EvfCvKJ7tpqXdblVfeX8Qe3lqVwrtf63voL4jO04QpD6qrRAYTJrOHIqmft99m6rfsXk6GwOgb51ZwoTvkyve3EJxPTg6sbTY_A33EpXxAka-0ih8nXo_TSSW-KpomkWdJH11LyioFVEuODNV5aAMIR5mLv4m0SVMUOFaP554fbe_CgJGb5WoLad6Muwwsf2dVzUf2we5cq87sm4ddXpDVj1mg83-xgcTouvS6abng4XAEvLMp9A-qnuxlSNdLfOErCG0yRmvyRRdZZK-tc-kHySwbUFKL0eCMojoom1mFISGia-kbKicLHO6J3lP0UXkQGC6W5mweGbgMiZF4COT5_A-ks2QWNhHvUDQWQV8oleShf-5JrphICxQl-EhPGwE1PiNNDSdBTHMadtmilanA1bBwnd4bsMm8ZS8BWgkAQWY4HBQcypNWa5b6PwhRIKobUTBGyZpNZTfkx9rby3v4Ngi4hseKA4vs-vO5mf2me5x0jY6vvJ86glGbg0Cs10W2AqAGCdnakXwF7wUmBqDycaLOty4aZHr9epC30ztFKRoWCAASEuRo5mKbRucpMWiQRJV0A46rXmAB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:05:28 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211020/r20110914/ Frame CE04 23 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211020/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f15dc13ebdca8972b7eeb648108b804feb40f890ae25cc14cf5a3b1379726a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:10:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2347
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9298
x-xss-protection: 0
server: cafe
etag: 5575107075035495308
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:10:36 GMT

GET
H2

200

user
ads3.admatic.com.tr/ Frame CB79
Redirect Chain

https://x.bidswitch.net/sync?ssp=admatic
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=admatic&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=93&user_id=885cb34c-bf55-48a9-adcd-4ce806d857bb&expires=30&ssp=admatic&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
https://ads4.admatic.com.tr/showad/px/ums/sync/bsw?bsw_uuid=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627&dsp_uuid=&dsp_id=
https://ads3.admatic.com.tr/user?bsw_uuid=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627&dsp_uuid=&dsp_id=

35 B
82 B

49ms
48ms

Image
image/gif

188.132.147.228
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads3.admatic.com.tr/user?bsw_uuid=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627&dsp_uuid=&dsp_id=
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
server: AdMatic
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
x-powered-by: AdMatic
content-type: image/gif
cache-control: no-cache
timing-allow-origin: *
content-length: 35

Redirect headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
location: https://ads3.admatic.com.tr/user?bsw_uuid=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627&dsp_uuid=&dsp_id=
x-powered-by: AdMatic
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: text/html; charset=utf-8
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
content-length: 221

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7CA7 0
56 B 43ms
43ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2SHrJmR6YYCDPMSnx_APufuG8AsAAAAAOAHgBAI&bg=!lZalltLNAAbUs_yW1LM7ACkAdvg8WhMI_5FxxxuuRhxwUgLCTKWjoR5EFrCqaO81AfcYrxeD2Pht_gIAAACnUgAAACJoAQeZAwtxMvullem_Z7ArjEcTW1ZWJ7wIv4eYgd6jEMaYoSt7i0OMojoNQ9ef1D_L0q1UfH-3vmphWfaZa2KqF9UhwEsBn4osbbF5qhMr6wmooUOGk7bkBd_RRO_2YfKyMLU2bPVXMZp1x3rLcjUQlGX_3skCRifyIg-7Ky2VeztTKRixhXct7apTRRPmrXJui0dkIoncK279wyaEieheIp1mU5bpakOQHrWgX0uER07rsKMXdmO5vcpYhq4vywunqabEWO4XoZwOEoIFRcRQkeagH9HlHOY06MCT6PuSykTsLNpQ2sXEhGD0wqBxQdABtcfjldmIXB2vVEnXIhJv1wU043zz3lzbCVyismhPEPecKb36FK9v9t_0zIRjjayCkAHs8nfSMuZRUOcoyGR-D4aksCL6ebUl_lbkwtcJa1dtYJ_hzI0aJBCfZlWiAbaDytAdtSFRov1a8s4HAk-wBnyhRvekpTg8RR9U-Mgv7IIPWQhjd1n0JAUEyG2sv-LCCHnJJxeSDEKD1rHUBZUMYWFFtotrAm8wT-Ajv_WYHac6G_n4LE_O5t7bQpSBOOGqvOzF50SxznKyk7M4NvyTspaafxvuJSNXzNEKv7qXQbh66XvxjPvwEFxVjqqOyBgeBBrRvBpDOR-tCf3Zn1pKGIfdckn0DF8_zD_-yvRFKru7T3pAC6lqTcCSqIbgaog7OiBUGjbFfbN7S71-s89V38KK3Bn_-1Bsa7E-G4U8y9mcKt-9DNabBm2M2-wtNFrJBn-hI1heZEfuR7I5cL5BqpJkGsPkBmbI4Wd5vpvX2NvrE1AF7sRm3XjhO5MS4GmYqvVREfIRezSGZv8-Kqt2qMwjOLgpYFeN-97sEMcNXnHfDMSeERWvLoMSytRwFM9GWWaezaiYCDv7-4O5sCsbNZkRWXk0UZft7gSuvaHhHKFtAoRmqacHr_j3FAItYCrjkUa2RoESvB_lyiBOuhpBe1dBisbqj1M5zCR7tCq-dC7phWCaqLOUxuBQblNGRC-GFzAIARY_JgpReyVNhCGqLQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/10774078/1632247886950/ Frame 4E5C 13 KB
4 KB 7ms
7ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10774078/1632247886950/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32992e1a0660f9a5fadd831e2d47bd356a9644a4a41e6691a068a96ae4d5550d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 3748
date: Wed, 27 Oct 2021 10:11:44 GMT
expires: Thu, 28 Oct 2021 10:11:44 GMT
last-modified: Tue, 21 Sep 2021 18:11:26 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 81479
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame CE04 0
23 B 42ms
42ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss-69O89FAuRpsaXdb3uH2__o2LgYI3UL2aRPrCGPzEYxpXnoRXFjXgOJ21orTZLv1bMkL4BvTi4K4bWwANPGAkoL2T3VJznF-8KCa-I9KvbnEIsInkvakETdO9ECWAgk5p_wLsytIbJwCU5ovKlpoifQ&sai=AMfl-YRYyiJWion2I6e85TRsrGbbmTxYGVRpG5lU4g_AtzyJVmyNYuneNBTY09wCizvlcRn7K8O6mMqin1dpEOYBm9AF8thVUYflcy4&sig=Cg0ArKJSzJh_J42tfq-9EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=41&cbvp=1&cstd=39&cisv=r20211020.58836&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK crum
dsum-sec.casalemedia.com/ Frame 7907 43 B
1 KB 27ms
27ms Image
image/gif 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=0a0362f1-8c0c-4a03-b119-c2b6aad2c716&expiration=1643359783
Requested by: Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs&eq_cc=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://um2.eqads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 28 Oct 2021 08:49:43 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6E93 1 KB
783 B 7ms
6ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 27 Oct 2021 08:58:57 GMT
expires: Thu, 28 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 85846
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
DATA 200
OK truncated
/ Frame CE04 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fcb0ceaa4f6c5376ba8f6ddac4c6e3696ed7846672a185ce81d83671c9d74428

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js Show response
pagead2.googlesyndication.com/bg/ Frame C2D4 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad8b12962ae8e7b1e5a90d30d5daf381777909bcc20b06faa9d148b888f6cc8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 08:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89299
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13232
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 08:01:24 GMT

GET
H2 200 d7f1c17162b23a1997e2a6527b94d5e7.js Show response
s0.2mdn.net/10774078/1632247886950/ Frame 4E5C 65 KB
17 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10774078/1632247886950/d7f1c17162b23a1997e2a6527b94d5e7.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247886950/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89fcc0375149a3f29180c96159cca98bffe1e6bbb2ba93727628c90ccaa91db5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247886950/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85774
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17207
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:11:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:00:09 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 6E93 0
141 B 36ms
15ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEM12N0sqKXJXoaA9X8gdRJo&google_cver=1&google_push=AYg5qPI4S_bCfWtykE0Tef5ViO4QUjY3ugeD8MMMIDHFlSNjLkTF-jHrITvr3RAx6pAEMVEnRU9aRyzi6H0DxswjLxVWfokoP3A
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
via: 1.1 google
alt-svc: clear

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6E93
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEFKxIoHMIGHyIz-9LBfPCG4&google_cver=1&google_push=AYg5qPJIFFMq89Ib2GfToQf536w0Uv1y3TTx0sAS-wXzpZlSLPw9O2GOTjGeZQjIgdgE0wwMRXhl5ZghNnYQQz...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDAzNjY4MzIxNzIzODE3MA%3D%3D&google_push=AYg5qPJIFFMq89Ib2GfToQf536w0Uv1y3TTx0sAS-wXzpZlSLPw9O2GOTjGeZQjIgdgE0wwMRXhl5ZghNnYQQzbBKE...

170 B
188 B

18ms
17ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDAzNjY4MzIxNzIzODE3MA%3D%3D&google_push=AYg5qPJIFFMq89Ib2GfToQf536w0Uv1y3TTx0sAS-wXzpZlSLPw9O2GOTjGeZQjIgdgE0wwMRXhl5ZghNnYQQzbBKEoYfihzL58

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDAzNjY4MzIxNzIzODE3MA%3D%3D&google_push=AYg5qPJIFFMq89Ib2GfToQf536w0Uv1y3TTx0sAS-wXzpZlSLPw9O2GOTjGeZQjIgdgE0wwMRXhl5ZghNnYQQzbBKEoYfihzL58
Date: Thu, 28 Oct 2021 08:49:43 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6E93
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESENNEkPYGN6A_RCLtt5hv_6I&google_cver=1&google_push=AYg5qPJ7Ux2HiwM3YCotNXKypJYN0BWZ-vNjaWkv53IFJBOHyLZXsek9qc67dYbafbNrxezfriNnLTLCmCslPdOiBMsj_iu...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJ7Ux2HiwM3YCotNXKypJYN0BWZ-vNjaWkv53IFJBOHyLZXsek9qc67dYbafbNrxezfriNnLTLCmCslPdOiBMsj_iuFcwg&google_hm=MzkyNTA1MjAwMjU3NTA3Mzg...

170 B
188 B

18ms
18ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJ7Ux2HiwM3YCotNXKypJYN0BWZ-vNjaWkv53IFJBOHyLZXsek9qc67dYbafbNrxezfriNnLTLCmCslPdOiBMsj_iuFcwg&google_hm=MzkyNTA1MjAwMjU3NTA3MzgxNw%3D%3D

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 28 Oct 2021 08:49:43 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJ7Ux2HiwM3YCotNXKypJYN0BWZ-vNjaWkv53IFJBOHyLZXsek9qc67dYbafbNrxezfriNnLTLCmCslPdOiBMsj_iuFcwg&google_hm=MzkyNTA1MjAwMjU3NTA3MzgxNw%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6E93
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEGaiVM87obOzz-bVQS7m9Jk&google_cver=1&google_push=AYg5qPJm8v3IgAqTYPnfzcjR0ovyQrAV4B6Zbo0llpVonN5-iK26scBTm36iEvcwRXgi25ajhZ9U7yLcPM3L1xSm-vrBoB7...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEGaiVM87obOzz-bVQS7m9Jk&google_cver=1&google_push=AYg5qPJm8v3IgAqTYPnfzcjR0ovyQrAV4B6Zbo0llpVonN5-iK26scBTm36iEvcwRXgi25ajhZ9U7yLcPM3L1xSm-vrBo...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJm8v3IgAqTYPnfzcjR0ovyQrAV4B6Zbo0llpVonN5-iK26scBTm36iEvcwRXgi25ajhZ9U7yLcPM3L1xSm-vrBoB7Nh7o

170 B
188 B

17ms
16ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJm8v3IgAqTYPnfzcjR0ovyQrAV4B6Zbo0llpVonN5-iK26scBTm36iEvcwRXgi25ajhZ9U7yLcPM3L1xSm-vrBoB7Nh7o

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJm8v3IgAqTYPnfzcjR0ovyQrAV4B6Zbo0llpVonN5-iK26scBTm36iEvcwRXgi25ajhZ9U7yLcPM3L1xSm-vrBoB7Nh7o
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6E93 0
12 B 15ms
14ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JsDrt4UfeTtyKAR9ymb06oGvRkaFUjcLnqSebzQq0kqEsZT7CZ

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 722604b2e7fa8c5a2993e8e44f5e4996.png
s0.2mdn.net/10774078/1632247886950/media/ Frame 4E5C 76 KB
76 KB 9ms
8ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247886950/media/722604b2e7fa8c5a2993e8e44f5e4996.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247886950/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55f9f17f0540d90673ce78a3eb5e966c080bafb47e1c417cefd860f0e025f6ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247886950/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:01:58 GMT
x-content-type-options: nosniff
age: 85665
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 77429
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:11:27 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:01:58 GMT

GET
H2 200 def6a7f659390a1953f3daa1330e53d4.svg
s0.2mdn.net/10774078/1632247886950/media/ Frame 4E5C 3 KB
966 B 7ms
7ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247886950/media/def6a7f659390a1953f3daa1330e53d4.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247886950/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac96a5caf0aa0eb751df57a25ae687eaec6721e16e33a582635880ca4a82916e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247886950/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85773
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 861
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:11:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:00:10 GMT

GET
H2 200 e5600b4cd2a6eaeac8ee4398e1df1bb0.svg
s0.2mdn.net/10774078/1632247886950/media/ Frame 4E5C 5 KB
2 KB 8ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247886950/media/e5600b4cd2a6eaeac8ee4398e1df1bb0.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247886950/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e7f9a9eb50d2440abf20bf3a222147b4de0c2abcb246b8ca4dc479bb21d0ecf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247886950/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85773
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1506
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:11:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:00:10 GMT

GET
H2 200 4ba9e0aa45ddee0e96f41d5830825006.svg
s0.2mdn.net/10774078/1632247886950/media/ Frame 4E5C 858 B
527 B 8ms
7ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247886950/media/4ba9e0aa45ddee0e96f41d5830825006.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247886950/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b3bfe44b23f2ffe459ade53779bff081a6b864bcc00863836d553e4881c79a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247886950/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85773
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 462
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:11:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:00:10 GMT

GET
H2 200 3986f8998b9de996c13efdbf72a05970.svg
s0.2mdn.net/10774078/1632247886950/media/ Frame 4E5C 7 KB
3 KB 15ms
14ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247886950/media/3986f8998b9de996c13efdbf72a05970.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247886950/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0007d23baa268a1cd61074407a65f5d2850f4f78a77d0cf141a0c0fdf8fc403f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247886950/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:01:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85665
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3072
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:11:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:01:58 GMT

GET
H2 200 dc_oe=ChMIgK7P1dzs8wIVxNMRCB25vQG-EAAYACDRwKBMQhMIxNi01dzs8wIVhsARCB28mgPF;met=1;&timestamp=1635410983599;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;
ade.googlesyndication.com/ddm/activity/ Frame 0C73 42 B
465 B 78ms
42ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIgK7P1dzs8wIVxNMRCB25vQG-EAAYACDRwKBMQhMIxNi01dzs8wIVhsARCB28mgPF;met=1;&timestamp=1635410983599;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A4BA 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 28 Oct 2021 08:49:42 GMT
expires: Fri, 28 Oct 2022 08:49:42 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame CE04 0
23 B 41ms
41ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss-69O89FAuRpsaXdb3uH2__o2LgYI3UL2aRPrCGPzEYxpXnoRXFjXgOJ21orTZLv1bMkL4BvTi4K4bWwANPGAkoL2T3VJznF-8KCa-I9KvbnEIsInkvakETdO9ECWAgk5p_wLsytIbJwCU5ovKlpoifQ&sai=AMfl-YRYyiJWion2I6e85TRsrGbbmTxYGVRpG5lU4g_AtzyJVmyNYuneNBTY09wCizvlcRn7K8O6mMqin1dpEOYBm9AF8thVUYflcy4&sig=Cg0ArKJSzJh_J42tfq-9EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=181&vt=11&dtpt=140&dett=3&cstd=39&cisv=r20211020.58836&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 412F 640 B
363 B 18ms
17ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnoIxCA2vS7Ahit0ZG1ATAB&v=APEucNVXnJljUPgvba6Xy-8oxJpGbZKUSfmu-XWU8KvQCCrqfBMHlGEEjIj3eOvQFM_iuEHvTVXk_T8ZjuCjmzULS4xySUMcyeF4ti6M_yv7KENHq6zAYvKVK7pnAVW0dIw7ywJzvWFVfxOuP1Jp2FkEguY6fCvt327ZbWn4lABKt1XqprsVbiU

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 28 Oct 2021 08:49:43 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A4BA 11 KB
9 KB 33ms
32ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A-Yv5by77g2Kd_m8lIJ7xstO4UH6YItTOARgctMFfuXVA3i63UHqWiBW5zH0f05Fzla9VFHmJ2rPVZ3lZdKeaGJfrLCxf2YqUi7NKEdYGN9jWSm6IE2Ph08EywXaEwmNSmzqe5kQiNiQ3coHIyiCBF6PQ8AA&dbm_d=AKAmf-A8y-cwXpVaJJK469Exbb7FLYw9T-mcXdT7OXDrB3eoAlFS8ihgbpi3_xE5myglHBpvakfZTp2JCjVghWqOTMI_EbjIdMfkAEKKptzDEvJpvk7YT829mZU5w2rR3r549_uheX_NSRYNGLFBaR0c1pTc7O_9RgergvlxKouWxojDi0kJJMOHLUI7CSXkxtC7KCLACYZjT_6t0gCu9COoVZMtEvzNTS-5_TnKbOMFx83raxQ0MLOM9ytZViPiLzBgX2hKzACHHz8uJo4QSQKLyirP0aLgNc5NCiL1cPWalKOV1yf3oCO95tRwra33p9K7XJQFDyXk2k3MnE1DHylx05jI_Wf_H8v_nfPUqcVccdNI257PdqF8z2Qlinql9KUzJ1Kmy599rG-NfXNhFQg9WbtrP8p6iiYQHGsmFlFSrJtC9zSCOGwauBJINCXEPmmOPpNmsUrv_5lek1TV0r9-jv52qM7neZWFXTiD3XN_i_CrXNA12qyDBJzFENXjVppuHDJVjFAVAZfppzBYe2mToMSJnw_6KI4wiGcJbheG3bAYbxMJEbHLHUqvauQcaGOUDBzcKZHW-gyzBAC8fsOJE0O1MvhQveBcOjdHiSSEunzxNh7Gm7MLJJZb_K06Cj8YYK9Mg7d5cY9QtKI2FW6amORxq0TZeWw0_fwKQZaX80LTHoScofnlgYWrWAl-48gZH0YB1IGX1mL2dJ-Dp8rwCr7GpiHy9CvACemSR-IJg5QEOihRPBKtMxL2iMwgTNC5E9KDr80rvClCcs1uoduRcOV8G5btbnOiktJN5mpjX5-EZQirlCs1uF2ZZWjMyreprPTUZBGtrwIA_-rZf_cbb0D_Wu4wIe4S3CgAh8uhpSB5ToN7hxrUhwt2rEZ1aTTWOSTmDzWwawpkUlo_uwzXg4gSEFQm9JQVTwRoaop7B1zQHC-w-JoAhzob5lzqGymJsKDleMEpsrw9ynmTOis4gCgEQL99lahWEf4hTAwy9XLx_JhW4c1933jNMHw8yc0k4c6S1aGOfIIEgvcamAckA3zdy7n7-tE0BjfI33-9XZNR6uDTcfbVb_icMNwAhRDSu06ZVmD5IlrU5tJE7lPu1Mm3_H2Ebjfsfx8TWIDOdRAx7-iScB8YNf_O9EwpxSGyTf_Ss23Rj0hbDEbzRPdsD32gQ2-qflVAS0Mcsv8jKRTB1yIvT-kjrkQWLWKV6mxQrDViRuuOk8f7pS7lERqPzqAuS2SvqdC_Gpsado-Kf1T4kdA0eqzdPkMxl2IW-puv9wbBsPg5tSFvF56KQ_rH4ySPP4S5J6Ooelyw8r8btkiDLt4oI2mdEH8h7xJXRzQsqrAinplZqQBQntWDjZRX2TOsaQAey9uPHnGqUcsS4LU9vC6pFizZRvt9nIgiqRuiq0d9-oxUIWAHqXGQLm3xqaLOFG71KfKD4wnPG-akx9GZ1MktpEKz02Krf1nexK6rAgQLIRSVpsn84vTVmqa4_NIQh5wqTYXqkwPhRT1-E86H6BFoG3LicKx0PAHB5bXqWRG2-RRqjOxj-YiJaOzA4g6kg3Bjl7KXvDyp2q7wRUH4r73OVJ4wv4NxUWxBq1wZdvnT3AIHseUcSNZd01d9biC4e7prqg17ucGHVc4Vqa-T2WRsjAw7zgsRmErNVL2TcHU_lrascDPw21-4WdOC02nEk1KmZU7vT1G0KM_b_VypUFQeDqQnqNviVeFq8uuomwD4a-8kLCTwUSNU-P0zkerr-lNPRZfnPYStUelNtHBph5EBxhEH6fN5KS4UabzEyOqWYcfwkMA8SkDtHhN6nwW9QFHYKfk4LuB3iSeCzCCpbSBTLtf3cHgEyZFMugaEftETrmpwJ300_2mM2TDlHNNpPc-dd4kkRSS9TLBB_J1li9KXJKLyTD8gMMGPYuWb0VPwh9DWxWsVgkzYZg6uXSO7pghxddiZAF1xak0BWmmzxBPF7yAmR72KbxVAeUxkPgTulSNRwp5urYedKpWwAZEhdgTB16fp0sH0Bp0oRnNehSc1oHOiIxs4csk8TXxc5r4BlYY7z3VPrSvkmhny7tMVopZj2kBAFoOAOXJw8tCiuZO6tdHliupNb57KC7CJFATRdxWSxFT4yDEb55tHGNO6P0AT-i_MXyPx4a_iUa569wUQMYSjKktn69tEK8XLX70lQGwtlozvz8eSyXmyhlSrvsBJDOdgEensvCkCrUHz4YJDVtLya33RGgB0SJdvpN-pSpPFDLOfbV3rLl4KvbZaVZqOvOZfRnsuslu5YMmii5NC3zkPMquSz_zu9H9QJsURLrpOFsg_tP3YlXVuGX0mjZ4XgWhRwmYsfHzOFbk5e9tXKBG5I5KCwVLn51FqbOGNkfq8p2ITFCwck2M3xsvbMDSwV5zudvhijmmxrf2KOU3HwwKRO4hwspduKXK7uF92nWYYQo_3hvSjcB5mkSCtM1j2TCD6R3c1J2u4VXGjN0ocy3ocSZpu-Fguxeee64VY-jkeH1VgxBf6YB-5I2ZRBvOu79AiTopnYl3aOK6JgMgDYmPMvQTifiQ2zdxfLo30PEXYrLEN3-hL_ghzvKG32ADWCWIqBtgV-4zGJoz4KcSf_sH9eoeSzOl1C_ofe0PGKoOc61XOkVgfKwiiGwEvscRFO0gyBQVwuF26PhDqAf5eUAQ&cid=CAASEuRofGVESsPKUf0u9Ntwjz4i2g&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b31cbe5938c8a5b35e9c4355093e61fec4c42a88dc58a0cc2f62bb567d28c886

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8736
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A4BA 42 B
107 B 40ms
38ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BZSVkHylBy0axNMGw4HnjTjY06PWNZqgEzk7ZCaW1Wdx3F6-iRT4pHZKMfYpvSnv5suc3DuqR5D-wfH4yH8psK3W_3NugRcVHAi6LLAml6wVXLgJU

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame A4BA 57 KB
19 KB 50ms
36ms Script
text/javascript 173.194.76.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWNOeo0r0O0FyDABGQcgkWRRlcqAIAg8IykKbbaI7cfMd8sov8&d=CnkAoCZ_4M_W3uBIPHwvxO0zkGGr_gIspjPijN9HPz2-nXfprorEyy9KdHOyy9wCqLIdiFrDH2uFcjngyRG042zUYHpxoLG2G99MnooftmutyARVoAjkK_xUTi0BxpJEjmz8LIc0aw4xCEU6_WYkSTHQP1So0yhONlgLEukRAKAmf-C7yui6Oqrth-8owWx9Nuz5ctQ1hTgGaipuPw0PNgsCTZEVIQL7MX9avWSvQVhOrU-CgLuSDdGapfDWEeImMNLJYz-nQybb-uNJhKeYc4xDrT5h87zoBBNsqEqJlTcIwm8M5qMhGf5_MRADk4HbtU_SHkzq1_nTlQLDF_yIKr0zErq37r9uWtVmAIKeLT7uhvEwhOI5DipxX035i2zbpbjSC3nkAkN4uJqtDnsbBkozYzy-rZ47la72WkNX3ujY6UPiFJUe7wsIl6MU0xowy0D5vyVIIzIVq_fgNSGbhyFNvFOnI5ECEVeWdHdz8rNVJNTnlqAaZ8buDWbut8RHPYhEEP883pllcPZHXcWlIB4J6S5gRStNt45T-DpYN5Wvb8ub-A3LZEebT0I8bBo5Tu2JQnk47cKx4dMXmAMI4h82mZxkTDAtPL3bCYBH7UlccnNiD-0ZuM4R0KwCajCKWIkTfFDhiTTUcZbp7hmYcfJjltlZmcNQU1m34VYRuqSesyGL2Byg5mWe9AkhkXTvd-uOZfwDBRFD_HiVMhkk7bbGH4lEvbmpyJ9MtfVLGE4dN6K3iDcXHEe7kvJ3SUiBlMgvAxbhPiKxebwhNXyTymYLJMccqHDLw3hcvh7jUrfo66pVGXTvYyBdP4c16-ZYTlcxEEcz1xIzYnHPpGIWZeYL0Zswr5Cx1PRCqsXwANKS0lPPY4VouKnudubkUCCNvqdM8balO8ASVY0IvjRo6MhngqyZwo4RlJfnH7dnP1y3b02boYS8_2tquZdycamjkrIkV5bEQFHqPi6W8j3JkwqkTbsJ283QMhKCPRMlfbwu_sTN3WtAeQDhg3IQ14gckALoKLTEpRX_ZBVYpBq0NEsPTGp0PB_7yWHZDJLt8c46LOE1JyI1luNCJEw2eiIfIpRUXfVQxezvXf5Xb4HIWlhzV7h6vr99GpIqzYOQpeJaRKpCIvn_jNGQLR4-cPIKyqtkbW_VwRKMI_RfFZleLiH1lIi4qqlMwafwx-xFOxkMSuHnqOpwGm8DiLRoFRPBguwkzsyz6gzx9NU0_-uN81bOJ6XoahcccvIq-C0dYMBlDUzETihjAP_GYHq9nZkNfdu59Gmgp10Sg5sVtJEEIaBgSFr208Bm_CBdrk68gToZJpPyLCfxJm48qBgACcXOcDwNMheSSwSB1cZVHBNoBinqxcUmfXzMAaimaH4RFLqh7JtElsVblWwtwWdcIIUaFsBSK1R4uawxoMn587jXwC_8kIAi2wJx45uofxnhNqEIKu-w-EMkDslCTUxoG7x_lOQ5bYQQMK9WDvxKb3jTD47axuawcRS3-Yfw1iqrtSjWVvlJCGorYkqr5Zwoek8kREk2nWEGxzzVbv8i7__T0WjJe58CDtKfsWvCY7eK3jVcxABkg-2a1o2PoJzXkqq-yvprENm3rgu0MBw9WkXABnr5kMiGBZnF6vvxTzy3PGPo86I7TmTImlDZe6axrcnzcGVzujeuaob2jL-W6ad5FLWKAD8Pd5xAMj7c38xsLO60hXhZYrdZH4noizqW5QBVIkmAeOpurCbJdoiauiQAXAmo4KpbSvoPwIFB96-nNefnOm48_z1SfbYL1_1ohyYy4BSzeFv6keEypXwAiZDx4dQptDUayNeduzk1X7VL6CnzBgSFiyR7JHoCIxOqC3Qd3_LAgBCrI0OBkBDWZFKoAvtZnHpFJoiQhA7EozDFQRNX4inRDfeHVP52o63KMt0ZR5P5uTGplKjCk3au69tm7bGlOzU2Igrcsy5AjFjqK7XJyTSHRAYJiTqX9hRI8RnZ0ulkSLdUcfe7mP7sK4-JOXJ0NWrfS_MCrMbCCfVJMD7ZN9O5zrhkG7C4Fy9oiyjsRwzEBv0lgCF79i_5mZ53kYzOrwr82yVdlrFDx4vElwI_iGwQL2svDuspNr98LIvQ5rcVOqmIeRvxKSoteb0Y1Aw81WsM6Mk49h7pbhZZlsV3-nFNNArbRfj84Dk0gQrHUl2nk_0IQkbF4omJ5sjvNwsROy-5aaeu-KOpg3kzPCLcPCDi3_e4UMSFmiYLAw-AYqWTqU_mczOu7FWJBK3MY9ZE02L7Qf_UUKiHnSsHLFqechBkiy5cYHUk-l0sSz7WlvGZa_xVO1VXegNXK4E06hE63dEj4_iONjXpfIOh_EB_BH65IMQG1gkYpvu-H4X2fjvQW8aPuXil0dkqFEZhepfZZI5B1gZDpBqck5MPlvpjThqcOLHRVQqCqoRRI2m_ivXklTqD4yS8qLfrr-zLvyqK-b7IPXnxe3WCIH1lK4idUOiUnTTraLEK8FMaZhWt-I5DuSqbvu2btOiP4m4PXqxZUeh3zI9Uf5C8BDtqNfAbHe6uML8k611CCG2KPX7GAL2bQAWqO1GMtKle793pf3MYRiORvPDpbwP_VDIFrgLD4yJb50XxUbln3s1WgS8LhCpmiSmOvM5hQWf6DqmHWyxMS2KBb46URvz7iJZqrlR7diqv_uetFVt9i78kSMNOdk8GHN6JH37gk3_i_FiaNWtT8o7SFuq2yCFmaK2J_zRiTwBRjn9DdoSHigLSqQ6jIUOVos93EtO4SQ3fsmXtWCPRJIDjKK7RoVtkyIx7Xbnk1Zdxfjwl4uISvLoR0-VEiJOEXyeE1jtjBa1YvLGLfTgPWNtnSfX-88cyc6wwRpGAtvnPpAdvh7yK-uuMMAIosrqQygY94rwFWyt5hiSOO4x57pNlekKI4I_HRhuzKpnZaXtPDgqq_GDHYK_QclAdX_KHHzy1nwgTZvPax8tGpm-zziewWMAnNBDjQboPokBMc9l5NTuXUPi7Xn42tZrDGisSu6pX0C0xX_UwwiSMB8cgoJgX7-uePIszclF_7Ia1bnOEXSNloTmWRm_AT543HzlQrv8B1ePnoXbqSf7eVoYKxkI0b-LshDzGy8bg_iJjijw1eAGj72t6rfKzMleGDWzgdw4El5tId0INi5xb-Bn3a6ROG_n_ovT_UDDZOxe6IgjyiOPHp4va8y6XUOxZ4drxG6fG1xoWCAASEuRofGVESsPKUf0u9Ntwjz4i2mAB

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.76.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f156.1e100.net

Software

cafe /

Resource Hash

959764226b186a2a788c077ce6dd56939eb7d4e9271eb277e8c759ea558d7e31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19009
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca Show response
choices.truste.com/ Frame A4BA 27 KB
9 KB 9ms
8ms Script
text/javascript 143.204.98.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=2&c=digitas01cont8&w=728&h=90
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.27 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-27.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: a15e6e8b0a81deeeea88e6ed517e1a97aad88ead078c853ecb66b2007d291085

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Oct 2021 09:32:01 GMT
content-encoding: gzip
server: nginx
age: 83862
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: fWTUl_2f-YPbaw4akyozJVei6Xb08LVsFkJvLTlL9-TGdpjN9KrOZA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame A4BA 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/window_focus_fy2019.js

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:46:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 184
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:46:39 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A4BA 120 KB
37 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1635161763799786"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 28 Oct 2021 08:49:43 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame A4BA 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:46:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:46:13 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame A4BA 0
0 15ms
14ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTCoGZg24GKYf1z76OZE58xMBbUhF0GxXniyvxcygCBBAKTKVgTd3O-_Mia_ibB6hn0SKKagKY7szlG65EhnxKxY-4hEw
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 412F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEImpV8nIx43VoxxJeczIjUg&google_cver=1

43 B
114 B

17ms
17ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEImpV8nIx43VoxxJeczIjUg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnoIxCA2vS7Ahit0ZG1ATAB&v=APEucNVXnJljUPgvba6Xy-8oxJpGbZKUSfmu-XWU8KvQCCrqfBMHlGEEjIj3eOvQFM_iuEHvTVXk_T8ZjuCjmzULS4xySUMcyeF4ti6M_yv7KENHq6zAYvKVK7pnAVW0dIw7ywJzvWFVfxOuP1Jp2FkEguY6fCvt327ZbWn4lABKt1XqprsVbiU
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEImpV8nIx43VoxxJeczIjUg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 412F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YTA4NTMzMTMtMDQyNC0yYTc2LWRhMDAtZjJlN2JmNTlmMjVl

170 B
188 B

16ms
16ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YTA4NTMzMTMtMDQyNC0yYTc2LWRhMDAtZjJlN2JmNTlmMjVl

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnoIxCA2vS7Ahit0ZG1ATAB&v=APEucNVXnJljUPgvba6Xy-8oxJpGbZKUSfmu-XWU8KvQCCrqfBMHlGEEjIj3eOvQFM_iuEHvTVXk_T8ZjuCjmzULS4xySUMcyeF4ti6M_yv7KENHq6zAYvKVK7pnAVW0dIw7ywJzvWFVfxOuP1Jp2FkEguY6fCvt327ZbWn4lABKt1XqprsVbiU

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: gzip
server: OXGW/16.217.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YTA4NTMzMTMtMDQyNC0yYTc2LWRhMDAtZjJlN2JmNTlmMjVl
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 412F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEDHLqH6aTlwl9otLLsHqucc&google_cver=1

23 B
172 B

56ms
34ms

Image
image/gif

184.31.88.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEDHLqH6aTlwl9otLLsHqucc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnoIxCA2vS7Ahit0ZG1ATAB&v=APEucNVXnJljUPgvba6Xy-8oxJpGbZKUSfmu-XWU8KvQCCrqfBMHlGEEjIj3eOvQFM_iuEHvTVXk_T8ZjuCjmzULS4xySUMcyeF4ti6M_yv7KENHq6zAYvKVK7pnAVW0dIw7ywJzvWFVfxOuP1Jp2FkEguY6fCvt327ZbWn4lABKt1XqprsVbiU
Protocol: H2
Server: 184.31.88.106 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-88-106.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 28 Oct 2021 08:49:43 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEDHLqH6aTlwl9otLLsHqucc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 412F 23 B
172 B 72ms
32ms Image
image/gif 184.31.88.106
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnoIxCA2vS7Ahit0ZG1ATAB&v=APEucNVXnJljUPgvba6Xy-8oxJpGbZKUSfmu-XWU8KvQCCrqfBMHlGEEjIj3eOvQFM_iuEHvTVXk_T8ZjuCjmzULS4xySUMcyeF4ti6M_yv7KENHq6zAYvKVK7pnAVW0dIw7ywJzvWFVfxOuP1Jp2FkEguY6fCvt327ZbWn4lABKt1XqprsVbiU
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.88.106 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-88-106.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 28 Oct 2021 08:49:43 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A4BA 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A-Yv5by77g2Kd_m8lIJ7xstO4UH6YItTOARgctMFfuXVA3i63UHqWiBW5zH0f05Fzla9VFHmJ2rPVZ3lZdKeaGJfrLCxf2YqUi7NKEdYGN9jWSm6IE2Ph08EywXaEwmNSmzqe5kQiNiQ3coHIyiCBF6PQ8AA&dbm_d=AKAmf-A8y-cwXpVaJJK469Exbb7FLYw9T-mcXdT7OXDrB3eoAlFS8ihgbpi3_xE5myglHBpvakfZTp2JCjVghWqOTMI_EbjIdMfkAEKKptzDEvJpvk7YT829mZU5w2rR3r549_uheX_NSRYNGLFBaR0c1pTc7O_9RgergvlxKouWxojDi0kJJMOHLUI7CSXkxtC7KCLACYZjT_6t0gCu9COoVZMtEvzNTS-5_TnKbOMFx83raxQ0MLOM9ytZViPiLzBgX2hKzACHHz8uJo4QSQKLyirP0aLgNc5NCiL1cPWalKOV1yf3oCO95tRwra33p9K7XJQFDyXk2k3MnE1DHylx05jI_Wf_H8v_nfPUqcVccdNI257PdqF8z2Qlinql9KUzJ1Kmy599rG-NfXNhFQg9WbtrP8p6iiYQHGsmFlFSrJtC9zSCOGwauBJINCXEPmmOPpNmsUrv_5lek1TV0r9-jv52qM7neZWFXTiD3XN_i_CrXNA12qyDBJzFENXjVppuHDJVjFAVAZfppzBYe2mToMSJnw_6KI4wiGcJbheG3bAYbxMJEbHLHUqvauQcaGOUDBzcKZHW-gyzBAC8fsOJE0O1MvhQveBcOjdHiSSEunzxNh7Gm7MLJJZb_K06Cj8YYK9Mg7d5cY9QtKI2FW6amORxq0TZeWw0_fwKQZaX80LTHoScofnlgYWrWAl-48gZH0YB1IGX1mL2dJ-Dp8rwCr7GpiHy9CvACemSR-IJg5QEOihRPBKtMxL2iMwgTNC5E9KDr80rvClCcs1uoduRcOV8G5btbnOiktJN5mpjX5-EZQirlCs1uF2ZZWjMyreprPTUZBGtrwIA_-rZf_cbb0D_Wu4wIe4S3CgAh8uhpSB5ToN7hxrUhwt2rEZ1aTTWOSTmDzWwawpkUlo_uwzXg4gSEFQm9JQVTwRoaop7B1zQHC-w-JoAhzob5lzqGymJsKDleMEpsrw9ynmTOis4gCgEQL99lahWEf4hTAwy9XLx_JhW4c1933jNMHw8yc0k4c6S1aGOfIIEgvcamAckA3zdy7n7-tE0BjfI33-9XZNR6uDTcfbVb_icMNwAhRDSu06ZVmD5IlrU5tJE7lPu1Mm3_H2Ebjfsfx8TWIDOdRAx7-iScB8YNf_O9EwpxSGyTf_Ss23Rj0hbDEbzRPdsD32gQ2-qflVAS0Mcsv8jKRTB1yIvT-kjrkQWLWKV6mxQrDViRuuOk8f7pS7lERqPzqAuS2SvqdC_Gpsado-Kf1T4kdA0eqzdPkMxl2IW-puv9wbBsPg5tSFvF56KQ_rH4ySPP4S5J6Ooelyw8r8btkiDLt4oI2mdEH8h7xJXRzQsqrAinplZqQBQntWDjZRX2TOsaQAey9uPHnGqUcsS4LU9vC6pFizZRvt9nIgiqRuiq0d9-oxUIWAHqXGQLm3xqaLOFG71KfKD4wnPG-akx9GZ1MktpEKz02Krf1nexK6rAgQLIRSVpsn84vTVmqa4_NIQh5wqTYXqkwPhRT1-E86H6BFoG3LicKx0PAHB5bXqWRG2-RRqjOxj-YiJaOzA4g6kg3Bjl7KXvDyp2q7wRUH4r73OVJ4wv4NxUWxBq1wZdvnT3AIHseUcSNZd01d9biC4e7prqg17ucGHVc4Vqa-T2WRsjAw7zgsRmErNVL2TcHU_lrascDPw21-4WdOC02nEk1KmZU7vT1G0KM_b_VypUFQeDqQnqNviVeFq8uuomwD4a-8kLCTwUSNU-P0zkerr-lNPRZfnPYStUelNtHBph5EBxhEH6fN5KS4UabzEyOqWYcfwkMA8SkDtHhN6nwW9QFHYKfk4LuB3iSeCzCCpbSBTLtf3cHgEyZFMugaEftETrmpwJ300_2mM2TDlHNNpPc-dd4kkRSS9TLBB_J1li9KXJKLyTD8gMMGPYuWb0VPwh9DWxWsVgkzYZg6uXSO7pghxddiZAF1xak0BWmmzxBPF7yAmR72KbxVAeUxkPgTulSNRwp5urYedKpWwAZEhdgTB16fp0sH0Bp0oRnNehSc1oHOiIxs4csk8TXxc5r4BlYY7z3VPrSvkmhny7tMVopZj2kBAFoOAOXJw8tCiuZO6tdHliupNb57KC7CJFATRdxWSxFT4yDEb55tHGNO6P0AT-i_MXyPx4a_iUa569wUQMYSjKktn69tEK8XLX70lQGwtlozvz8eSyXmyhlSrvsBJDOdgEensvCkCrUHz4YJDVtLya33RGgB0SJdvpN-pSpPFDLOfbV3rLl4KvbZaVZqOvOZfRnsuslu5YMmii5NC3zkPMquSz_zu9H9QJsURLrpOFsg_tP3YlXVuGX0mjZ4XgWhRwmYsfHzOFbk5e9tXKBG5I5KCwVLn51FqbOGNkfq8p2ITFCwck2M3xsvbMDSwV5zudvhijmmxrf2KOU3HwwKRO4hwspduKXK7uF92nWYYQo_3hvSjcB5mkSCtM1j2TCD6R3c1J2u4VXGjN0ocy3ocSZpu-Fguxeee64VY-jkeH1VgxBf6YB-5I2ZRBvOu79AiTopnYl3aOK6JgMgDYmPMvQTifiQ2zdxfLo30PEXYrLEN3-hL_ghzvKG32ADWCWIqBtgV-4zGJoz4KcSf_sH9eoeSzOl1C_ofe0PGKoOc61XOkVgfKwiiGwEvscRFO0gyBQVwuF26PhDqAf5eUAQ&cid=CAASEuRofGVESsPKUf0u9Ntwjz4i2g&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 14:26:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66222
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 27 Oct 2022 14:26:01 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame A4BA 106 KB
37 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Origin: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 14:26:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66222
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 14:26:01 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211020/r20110914/elements/html/ Frame A4BA 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211020/r20110914/elements/html/omrhp.js

Requested by

Host: bid.g.doubleclick.net
URL: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNWNOeo0r0O0FyDABGQcgkWRRlcqAIAg8IykKbbaI7cfMd8sov8&d=CnkAoCZ_4M_W3uBIPHwvxO0zkGGr_gIspjPijN9HPz2-nXfprorEyy9KdHOyy9wCqLIdiFrDH2uFcjngyRG042zUYHpxoLG2G99MnooftmutyARVoAjkK_xUTi0BxpJEjmz8LIc0aw4xCEU6_WYkSTHQP1So0yhONlgLEukRAKAmf-C7yui6Oqrth-8owWx9Nuz5ctQ1hTgGaipuPw0PNgsCTZEVIQL7MX9avWSvQVhOrU-CgLuSDdGapfDWEeImMNLJYz-nQybb-uNJhKeYc4xDrT5h87zoBBNsqEqJlTcIwm8M5qMhGf5_MRADk4HbtU_SHkzq1_nTlQLDF_yIKr0zErq37r9uWtVmAIKeLT7uhvEwhOI5DipxX035i2zbpbjSC3nkAkN4uJqtDnsbBkozYzy-rZ47la72WkNX3ujY6UPiFJUe7wsIl6MU0xowy0D5vyVIIzIVq_fgNSGbhyFNvFOnI5ECEVeWdHdz8rNVJNTnlqAaZ8buDWbut8RHPYhEEP883pllcPZHXcWlIB4J6S5gRStNt45T-DpYN5Wvb8ub-A3LZEebT0I8bBo5Tu2JQnk47cKx4dMXmAMI4h82mZxkTDAtPL3bCYBH7UlccnNiD-0ZuM4R0KwCajCKWIkTfFDhiTTUcZbp7hmYcfJjltlZmcNQU1m34VYRuqSesyGL2Byg5mWe9AkhkXTvd-uOZfwDBRFD_HiVMhkk7bbGH4lEvbmpyJ9MtfVLGE4dN6K3iDcXHEe7kvJ3SUiBlMgvAxbhPiKxebwhNXyTymYLJMccqHDLw3hcvh7jUrfo66pVGXTvYyBdP4c16-ZYTlcxEEcz1xIzYnHPpGIWZeYL0Zswr5Cx1PRCqsXwANKS0lPPY4VouKnudubkUCCNvqdM8balO8ASVY0IvjRo6MhngqyZwo4RlJfnH7dnP1y3b02boYS8_2tquZdycamjkrIkV5bEQFHqPi6W8j3JkwqkTbsJ283QMhKCPRMlfbwu_sTN3WtAeQDhg3IQ14gckALoKLTEpRX_ZBVYpBq0NEsPTGp0PB_7yWHZDJLt8c46LOE1JyI1luNCJEw2eiIfIpRUXfVQxezvXf5Xb4HIWlhzV7h6vr99GpIqzYOQpeJaRKpCIvn_jNGQLR4-cPIKyqtkbW_VwRKMI_RfFZleLiH1lIi4qqlMwafwx-xFOxkMSuHnqOpwGm8DiLRoFRPBguwkzsyz6gzx9NU0_-uN81bOJ6XoahcccvIq-C0dYMBlDUzETihjAP_GYHq9nZkNfdu59Gmgp10Sg5sVtJEEIaBgSFr208Bm_CBdrk68gToZJpPyLCfxJm48qBgACcXOcDwNMheSSwSB1cZVHBNoBinqxcUmfXzMAaimaH4RFLqh7JtElsVblWwtwWdcIIUaFsBSK1R4uawxoMn587jXwC_8kIAi2wJx45uofxnhNqEIKu-w-EMkDslCTUxoG7x_lOQ5bYQQMK9WDvxKb3jTD47axuawcRS3-Yfw1iqrtSjWVvlJCGorYkqr5Zwoek8kREk2nWEGxzzVbv8i7__T0WjJe58CDtKfsWvCY7eK3jVcxABkg-2a1o2PoJzXkqq-yvprENm3rgu0MBw9WkXABnr5kMiGBZnF6vvxTzy3PGPo86I7TmTImlDZe6axrcnzcGVzujeuaob2jL-W6ad5FLWKAD8Pd5xAMj7c38xsLO60hXhZYrdZH4noizqW5QBVIkmAeOpurCbJdoiauiQAXAmo4KpbSvoPwIFB96-nNefnOm48_z1SfbYL1_1ohyYy4BSzeFv6keEypXwAiZDx4dQptDUayNeduzk1X7VL6CnzBgSFiyR7JHoCIxOqC3Qd3_LAgBCrI0OBkBDWZFKoAvtZnHpFJoiQhA7EozDFQRNX4inRDfeHVP52o63KMt0ZR5P5uTGplKjCk3au69tm7bGlOzU2Igrcsy5AjFjqK7XJyTSHRAYJiTqX9hRI8RnZ0ulkSLdUcfe7mP7sK4-JOXJ0NWrfS_MCrMbCCfVJMD7ZN9O5zrhkG7C4Fy9oiyjsRwzEBv0lgCF79i_5mZ53kYzOrwr82yVdlrFDx4vElwI_iGwQL2svDuspNr98LIvQ5rcVOqmIeRvxKSoteb0Y1Aw81WsM6Mk49h7pbhZZlsV3-nFNNArbRfj84Dk0gQrHUl2nk_0IQkbF4omJ5sjvNwsROy-5aaeu-KOpg3kzPCLcPCDi3_e4UMSFmiYLAw-AYqWTqU_mczOu7FWJBK3MY9ZE02L7Qf_UUKiHnSsHLFqechBkiy5cYHUk-l0sSz7WlvGZa_xVO1VXegNXK4E06hE63dEj4_iONjXpfIOh_EB_BH65IMQG1gkYpvu-H4X2fjvQW8aPuXil0dkqFEZhepfZZI5B1gZDpBqck5MPlvpjThqcOLHRVQqCqoRRI2m_ivXklTqD4yS8qLfrr-zLvyqK-b7IPXnxe3WCIH1lK4idUOiUnTTraLEK8FMaZhWt-I5DuSqbvu2btOiP4m4PXqxZUeh3zI9Uf5C8BDtqNfAbHe6uML8k611CCG2KPX7GAL2bQAWqO1GMtKle793pf3MYRiORvPDpbwP_VDIFrgLD4yJb50XxUbln3s1WgS8LhCpmiSmOvM5hQWf6DqmHWyxMS2KBb46URvz7iJZqrlR7diqv_uetFVt9i78kSMNOdk8GHN6JH37gk3_i_FiaNWtT8o7SFuq2yCFmaK2J_zRiTwBRjn9DdoSHigLSqQ6jIUOVos93EtO4SQ3fsmXtWCPRJIDjKK7RoVtkyIx7Xbnk1Zdxfjwl4uISvLoR0-VEiJOEXyeE1jtjBa1YvLGLfTgPWNtnSfX-88cyc6wwRpGAtvnPpAdvh7yK-uuMMAIosrqQygY94rwFWyt5hiSOO4x57pNlekKI4I_HRhuzKpnZaXtPDgqq_GDHYK_QclAdX_KHHzy1nwgTZvPax8tGpm-zziewWMAnNBDjQboPokBMc9l5NTuXUPi7Xn42tZrDGisSu6pX0C0xX_UwwiSMB8cgoJgX7-uePIszclF_7Ia1bnOEXSNloTmWRm_AT543HzlQrv8B1ePnoXbqSf7eVoYKxkI0b-LshDzGy8bg_iJjijw1eAGj72t6rfKzMleGDWzgdw4El5tId0INi5xb-Bn3a6ROG_n_ovT_UDDZOxe6IgjyiOPHp4va8y6XUOxZ4drxG6fG1xoWCAASEuRofGVESsPKUf0u9Ntwjz4i2mAB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:05:28 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211020/r20110914/ Frame A4BA 23 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211020/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f15dc13ebdca8972b7eeb648108b804feb40f890ae25cc14cf5a3b1379726a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:10:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2347
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9298
x-xss-protection: 0
server: cafe
etag: 5575107075035495308
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 11 Nov 2021 08:10:36 GMT

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B596 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 27 Oct 2021 14:26:02 GMT
expires: Thu, 27 Oct 2022 14:26:02 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 66221
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2D1E 1 KB
783 B 6ms
6ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 27 Oct 2021 08:58:57 GMT
expires: Thu, 28 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 85846
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
DATA 200
OK truncated
/ Frame A4BA 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17e8de352c690654706c98fbd4451c171287d6335daf728af6c06d31cd2b84c1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C2D4 0
47 B 44ms
44ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BLir3J2R6YcukFo74-gbhwbqAAgAAAAA4AeAEAg&bg=!JCelJ2PNAAbUs_yW1LM7ACkAdvg8WtoU70FeINL5Klhmq4LLbB7TWUY8aAdRxd_e2qzOzfMyKoIcZwIAAACNUgAAABJoAQcKAANfPyGZAwMDg6qW-S9BzwaLbrk-lROaIu4-84pNHEOIEM8-vKDmxPGcev82nELM3Vv6XAahCXGkkDU5ZO3heWw4yJH8aMkratjvBsRh_H-U-waj9NepFpxjVS5x5Gb3P0fNSf6wge9uexWXnqvDR3zOyhllXdvDCuFAuAOes6OQtLrrFyRSNP53FPnFbzp_m26WICnGMW4_taP3piYu8t2jwAJzCjLsKiUPdR79A_jRjm3BtUDqE_kfsfgRRL4chHj8ysc-iiwLZgclMoKnNReGMwSNv1EFDOXK_GW7_d16YrqoJYGlIqUElTidJ045KgW8N5R4yoUgFwkLy-vaggXU9Vb0R8yvOij-RyBcBUIriNL3obTeDa-POrC0Jtyp2OvLicGAsXoXN6yXaG4vPK9x-SUoKV4KZ044szDwY0kYxiVV24DYLSHViQzTsfub6g8YzRbUrmRGmVGIwxB3UK8e7psFzi0p-GpVu98Ou3fauB0IzMMRD9-nmLtnkXvIgVvbdmIYfVzjzEIskFKJCaNrKq3M2uQWXwQ_X0vZnGO-RR_q2cgxt3ebEUWZpFtea5bQx221A0WxWUVNnqG6wx9rQLevQNxgtoYgXBhFW4DXv7XiHCgDgZomtnDUcTNoe-9b_VIluXsJsDu1hypuL3Lh96uTEQKtMhDeu5fa8Nz90mwYsXkeHOb9jOf70hp3dyYoHPCtXAcVhBxNj5_clAmEwhr_J7KOjumf6PbtzLf6HDLE4VchjeblBvv-yXfdDCW7zV0X_DGJWC-Sm4VRJdGKRmRXql9AitcJcSwLYQL063FKx3plYHwAYuoQGZ2U670YjuD558icd4bCL4LHTKMa27P31k5VRz7_EVaHF_rllb5JrW2FeP32jvgMrFrWzB2vcRYOZ3rvj1TMP_gCKQJAi5doj0Y8GC22-9TMBfelEqCCSHRWKKKR076QX5ZLbndqRirCPD5VdT9_tKrzfl5980sr65cnkfbJ69K9WyAsl94TkZ3i8aKYef5XgO_4WmhYDJIQeRSIcwk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/10774078/1632247700594/ Frame 35EE 13 KB
4 KB 7ms
7ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10774078/1632247700594/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a9a8aa90d0074ce250c38c4aff4c1e20f86359aac6a401e3e4e6c179ceb0b43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 3759
date: Wed, 27 Oct 2021 09:00:12 GMT
expires: Thu, 28 Oct 2021 09:00:12 GMT
last-modified: Tue, 21 Sep 2021 18:08:20 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 85771
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A4BA 0
23 B 43ms
43ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuYYRJeLakITjdqKsTom8g-zYV0yuZetCA5eH1rcqkE4k5sWEmtKAgWDZs_JgvOgZK-qGAsRUSJSrHT2PQlAJX3iMJ2kdkSGwq8soGwGOOpQnmRfm6jA-pr0AmCjewd3IqUfMuvULqZ4wnWw9-eUnA5RQ&sai=AMfl-YRvqJL8cHCCHInC2mQk9JJA6yvxPlbvPFVp7-WMko8YHXgxkGhJ7hRyRtGF79VT26hxTUi6jLHbfbjEdwAZi-SDLpuur-RhAkY&sig=Cg0ArKJSzHIVzq7HtDd9EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=46&cbvp=1&cstd=44&cisv=r20211020.26836&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 2D1E
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEMZecT_CFMHVbY-2BumWpqU&google_cver=1&google_push=AYg5qPIBsA6_5JOVVBAlvm1yY5H_Lq8yJ-T-m49t_gADNf_6pF3vVieWBh8aMJ4QBM4errivmOqu1DQ7ITMYA9-oOZ4efUWg2cw
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDIwMjg4NDkxNDYxMDY0NDQ0Nw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMZecT_CFMHVbY-2BumWpqU&google_cver=1

43 B
407 B

16ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMZecT_CFMHVbY-2BumWpqU&google_cver=1
Requested by: Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 -, , ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMZecT_CFMHVbY-2BumWpqU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 2D1E
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEKrgqJiasCCath5fNG5kK_I&google_cver=1&google_push=AYg5qPL5N2DkQ9P1rQdiT-1m_NyuowBuFnosqIxICY5ghMyqiowL3POPtQaZw1qvVFDielLgSktfVr_kCBgvTaVGKkvKCLHRolUe&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKrgqJiasCCath5fNG5kK_I&google_cver=1&google_push=AYg5qPL5N2DkQ9P1rQdiT-1m_NyuowBuFnosqIxICY5ghMyqiowL3POPtQaZw1qvVFDielLgSktfVr_kCBgvTaVGKkvKCLHRolU...

43 B
442 B

181ms
171ms

Image
image/gif

2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKrgqJiasCCath5fNG5kK_I&google_cver=1&google_push=AYg5qPL5N2DkQ9P1rQdiT-1m_NyuowBuFnosqIxICY5ghMyqiowL3POPtQaZw1qvVFDielLgSktfVr_kCBgvTaVGKkvKCLHRolUe&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPL5N2DkQ9P1rQdiT-1m_NyuowBuFnosqIxICY5ghMyqiowL3POPtQaZw1qvVFDielLgSktfVr_kCBgvTaVGKkvKCLHRolUe%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:44 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6a52e999ed18062d-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 13
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6a52e998baff062d-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEKrgqJiasCCath5fNG5kK_I&google_cver=1&google_push=AYg5qPL5N2DkQ9P1rQdiT-1m_NyuowBuFnosqIxICY5ghMyqiowL3POPtQaZw1qvVFDielLgSktfVr_kCBgvTaVGKkvKCLHRolUe&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPL5N2DkQ9P1rQdiT-1m_NyuowBuFnosqIxICY5ghMyqiowL3POPtQaZw1qvVFDielLgSktfVr_kCBgvTaVGKkvKCLHRolUe%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D1E
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESECzk2TZLNURZBQjfmEAQG0w&google_cver=1&google_push=AYg5qPLsHplxnZdjhv7D2KQSHrs1vs_DdJXYDyE9LVTA1Ja5JNODmySuVKvQRLdtTnasR_k8NWk1iR1XNY8rcrBJLsJDWixLklzy
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3869AA0236D14BE88E9584BF9783CAFE&google_push=AYg5qPLsHplxnZdjhv7D2KQSHrs1vs_DdJXYDyE9LVTA1Ja5JNODmySuVKvQRLdtTnasR_k8NWk1iR1XNY8rcrB...

170 B
188 B

16ms
16ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3869AA0236D14BE88E9584BF9783CAFE&google_push=AYg5qPLsHplxnZdjhv7D2KQSHrs1vs_DdJXYDyE9LVTA1Ja5JNODmySuVKvQRLdtTnasR_k8NWk1iR1XNY8rcrBJLsJDWixLklzy

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
server: openresty
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3869AA0236D14BE88E9584BF9783CAFE&google_push=AYg5qPLsHplxnZdjhv7D2KQSHrs1vs_DdJXYDyE9LVTA1Ja5JNODmySuVKvQRLdtTnasR_k8NWk1iR1XNY8rcrBJLsJDWixLklzy
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 27 Oct 2021 08:49:43 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D1E
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEBaxSs0L9AQvaXAT7lZFzfs&google_cver=1&google_push=AYg5qPJnLJQADZK2G-CkUyds1pTAtfhG5ly1cAPh7-ksafZwqq2OIBk5huiFrm58J3HGsGT2shNcQJ9bqMp...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJnLJQADZK2G-CkUyds1pTAtfhG5ly1cAPh7-ksafZwqq2OIBk5huiFrm58J3HGsGT2shNcQJ9bqMpi7p8I3-jnOXuhVfc&google_hm=bwZMPAOkS7e_ADoG9_MSY0g

170 B
188 B

18ms
18ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJnLJQADZK2G-CkUyds1pTAtfhG5ly1cAPh7-ksafZwqq2OIBk5huiFrm58J3HGsGT2shNcQJ9bqMpi7p8I3-jnOXuhVfc&google_hm=bwZMPAOkS7e_ADoG9_MSY0g

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJnLJQADZK2G-CkUyds1pTAtfhG5ly1cAPh7-ksafZwqq2OIBk5huiFrm58J3HGsGT2shNcQJ9bqMpi7p8I3-jnOXuhVfc&google_hm=bwZMPAOkS7e_ADoG9_MSY0g
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

pixel
cm.g.doubleclick.net/ Frame 2D1E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXpkJTzVeRb-zY8hHFdTTwAABF8AAAIB&google_gid=CAESEId7oTrrYd3_tUSLI83E9mc&google_push=AYg5qPLk5l34-FvFQNxep81TUsTx5V2I4ddpP5G_QAuiftdimN8...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D1E
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEPjOvU7jYHIZqn2BcNiixeQ&google_cver=1&google_push=AYg5qPIzeTF7U6BzO83dH7vGKcHxz2KoOzdN51k6ihUyHTcW-MGCrRfAjCOSVGezq0N24PaxEi6esblrBUpYsZ3FF...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEPjOvU7jYHIZqn2BcNiixeQ&google_cver=1&google_push=AYg5qPIzeTF7U6BzO83dH7vGKcHxz2KoOzdN51k6ihUyHTcW-MGCrRfAjCOSVGezq0N24PaxEi6esblrBUpYsZ3FF...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIzeTF7U6BzO83dH7vGKcHxz2KoOzdN51k6ihUyHTcW-MGCrRfAjCOSVGezq0N24PaxEi6esblrBUpYsZ3FFseIwU0cjfOx&google_hm=ac818aeb22e2157f0800e0b5

170 B
188 B

27ms
27ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIzeTF7U6BzO83dH7vGKcHxz2KoOzdN51k6ihUyHTcW-MGCrRfAjCOSVGezq0N24PaxEi6esblrBUpYsZ3FFseIwU0cjfOx&google_hm=ac818aeb22e2157f0800e0b5

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 28 Oct 2021 08:49:43 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIzeTF7U6BzO83dH7vGKcHxz2KoOzdN51k6ihUyHTcW-MGCrRfAjCOSVGezq0N24PaxEi6esblrBUpYsZ3FFseIwU0cjfOx&google_hm=ac818aeb22e2157f0800e0b5
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2D1E
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIKZmqZEtT8mWIA3OoaHu2M&google_cver=1&google_push=AYg5qPLBVf6YEKANLiOiVMYy-SUtfC0LByrKb3jwRQhIFPGCIvffPVH-iLKe-EdkkatgTYiS-nK9EwtAg-8cZCHF...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLBVf6YEKANLiOiVMYy-SUtfC0LByrKb3jwRQhIFPGCIvffPVH-iLKe-EdkkatgTYiS-nK9EwtAg-8cZCHFlsKHiri4qA70

170 B
188 B

17ms
17ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLBVf6YEKANLiOiVMYy-SUtfC0LByrKb3jwRQhIFPGCIvffPVH-iLKe-EdkkatgTYiS-nK9EwtAg-8cZCHFlsKHiri4qA70

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 28 Oct 2021 08:49:44 GMT
via: 1.1 d55780b776b171387055eca956ae29a9.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA50-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLBVf6YEKANLiOiVMYy-SUtfC0LByrKb3jwRQhIFPGCIvffPVH-iLKe-EdkkatgTYiS-nK9EwtAg-8cZCHFlsKHiri4qA70
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: 7szmsyXZtqOeVwAOcUdwEkLN68igcBVuX4irI_fr0VJZ9lA14k0jww==

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2D1E 0
12 B 14ms
14ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LWBrVbcmCumaKyQJsZirJ3qbCZiyh7-iLwDuOiXBltQKMkKW61hGCYKUpJCyuk6KDXt_MS

Requested by

Host: e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com
URL: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:43 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js Show response
pagead2.googlesyndication.com/bg/ Frame B596 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rYsSliro57HlqQ0w1drzgXd5CbzCCwb6qdFIuIj2zIs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad8b12962ae8e7b1e5a90d30d5daf381777909bcc20b06faa9d148b888f6cc8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 08:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89299
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13232
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 08:01:24 GMT

GET
H2 200 d7f1c17162b23a1997e2a6527b94d5e7.js Show response
s0.2mdn.net/10774078/1632247700594/ Frame 35EE 65 KB
17 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10774078/1632247700594/d7f1c17162b23a1997e2a6527b94d5e7.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247700594/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89fcc0375149a3f29180c96159cca98bffe1e6bbb2ba93727628c90ccaa91db5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247700594/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85772
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17207
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:08:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:00:11 GMT

GET
H2 200 42f6d5572686419cfa4025784801a59f.png
s0.2mdn.net/10774078/1632247700594/media/ Frame 35EE 25 KB
25 KB 8ms
6ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247700594/media/42f6d5572686419cfa4025784801a59f.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247700594/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2af0c96c9be155aa17b2bb5ff95473c66daf98e95b07cee733079a1c1447d7e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247700594/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:00:30 GMT
x-content-type-options: nosniff
age: 85753
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25191
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:08:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:00:30 GMT

GET
H2 200 dc29fbcf6c44415ccfec3ca884ee77f7.svg
s0.2mdn.net/10774078/1632247700594/media/ Frame 35EE 3 KB
916 B 8ms
6ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247700594/media/dc29fbcf6c44415ccfec3ca884ee77f7.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247700594/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab25c6a17f3654f47c77617d2c89d7cdf480fb738fcaf16a63e863faadee00b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247700594/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85772
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 841
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:08:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:00:11 GMT

GET
H2 200 7f58bedc07afcf437e72af2fa5a2ac69.svg
s0.2mdn.net/10774078/1632247700594/media/ Frame 35EE 6 KB
2 KB 10ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247700594/media/7f58bedc07afcf437e72af2fa5a2ac69.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247700594/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91cf49c8559ba8967a0c9c72218e232ec1e520854279a85a78ce7742945b0e17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247700594/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 18:12:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52628
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1619
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:08:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 18:12:35 GMT

GET
H2 200 04bb30c261a900e19e7c98eeb3b61178.svg
s0.2mdn.net/10774078/1632247700594/media/ Frame 35EE 883 B
540 B 10ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247700594/media/04bb30c261a900e19e7c98eeb3b61178.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247700594/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df93c481ac6360a9bcb5c646b2d668b11fb731b68a13c834292914917c9b385e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247700594/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85753
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 465
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:08:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:00:30 GMT

GET
H2 200 3986f8998b9de996c13efdbf72a05970.svg
s0.2mdn.net/10774078/1632247700594/media/ Frame 35EE 7 KB
3 KB 9ms
7ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10774078/1632247700594/media/3986f8998b9de996c13efdbf72a05970.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10774078/1632247700594/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0007d23baa268a1cd61074407a65f5d2850f4f78a77d0cf141a0c0fdf8fc403f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10774078/1632247700594/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 09:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85753
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3072
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 18:08:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Oct 2021 09:00:30 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A4BA 0
23 B 42ms
42ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuYYRJeLakITjdqKsTom8g-zYV0yuZetCA5eH1rcqkE4k5sWEmtKAgWDZs_JgvOgZK-qGAsRUSJSrHT2PQlAJX3iMJ2kdkSGwq8soGwGOOpQnmRfm6jA-pr0AmCjewd3IqUfMuvULqZ4wnWw9-eUnA5RQ&sai=AMfl-YRvqJL8cHCCHInC2mQk9JJA6yvxPlbvPFVp7-WMko8YHXgxkGhJ7hRyRtGF79VT26hxTUi6jLHbfbjEdwAZi-SDLpuur-RhAkY&sig=Cg0ArKJSzHIVzq7HtDd9EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=128&vt=11&dtpt=82&dett=3&cstd=44&cisv=r20211020.26836&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
server: cafe

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 212ms
211ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 267ms
267ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B596 0
56 B 43ms
42ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BDsLbJ2R6YbLYKM7Z3wO49p-YAQAAAAA4AeAEAg&bg=!j4yljMjNAAbUs_yW1LM7ACkAdvg8Wrrpxj7Ivr8vr4pfY4h3o8KnhPb8dMjhndb5pn-kUAfMGIWBrQIAAABzUgAAAAtoAQcKAFujtdRcXRbz1RBUIKadbjSf-8pzzpuU5JNdudvMdfKrcw56Eb25jNXQO1WT2U_J9tBUFHeu6hkJn4sA4UhTEvxTEGupn6Jx0QZp6MOASrRXeWbiJe4lBZ4yRR9lmQLydqSDQCLAC3egLQT8v04L0pZLlR7-r6tLG4aE619SN5Dfwt93FuH0iIDl81Uyz9x1gT7JI2Isd8D6QCiRRxBH-5YjlSMlbG9MU_oFWBveHxOh1SwOEO1epU_VG8Nf2dqvxM6q2boaMByBgbgw0a2Zx9cFHkWHM_CuxxuEeuWmuW-E8hT4DLmb__0s2rPy4a1hP2S8Rjt1VMpYTR0XSp3FMeGJls2GDpO-Vzwa26qleJ4n518J_jteXjJwgup1xOrsCiVeERrDJP794u39Sjs8f9w3H-scBvTa6QTndyZTZuQtV1uRU3SKxkPO28cbqKttryFizUzrd6VjuuuDzz2IxCyMlpU-t67-bVUnGsrg3JahloqXvFpoxgZvIvDw1lstzyDiPyXeGkTkplSVAqTw6rfX0rBvgZ8m649vFwoij4seRK_7WdGamXfaKVHT9qLVHNaCQMNdBOoCK2ZAUbBXFWSmsv8VEKSKIyQDLcvd5-IUxi6bspyAGUkN8kBwcILLMLpuKkDZmTyc5Lo-YzZs-Iqffllq580kNeDMUxmD2cLMJV9N9r9SCHbiaQ8O0IeCGKFiE7SlyKw53S8DupbTcMenfLHc1elLjBxUXOonvWvxjtc26hGPxlMMvpqI8HimYGB5KtP6m2cQoo6--RNO9hJ7X1ICQigbc6op9mR2wwhWmvBvp_eYmwiTX212LewcAyhO1d_ZzdC2r3EAM0THCxTVgca1z3H9PBBWC6eHWgKqqTcwFgUFG0ouSe_yIHCh70qoYYlqH54R1p3njxDWVbayqpaneqrZ8GMYccSi_L6Yu17WTltzZwNfN82U0_GVqYKvOSfq4fGsZsAjTxgSwtGBI5wk0PyyGgUsI0bDNK0p125VJ2t0Ny-0VtguppEj4izEDzxewdlyiko5i-SpUr--ofib7PBM2SllmpvQuNENkGny5RKo3tTxHeFqjHUTVllIPIEngQSYZk3q4Bu0pfqszuciTxiyl3ziVbC0Y_L7IA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 17ms
17ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTM2JaNypaZypyRcoWU9MTYmNTQkMDx4MSZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA1NDY0JaN0YT0jJat9NwxjJax9MmxjJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9qW5xZWZcozVxX2ZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow1BQyQyMwAyMxYyMwBNYWqhnXRyQzyxQWRdJTIjJTJGJTIjMvUlMCUlRvUlMDAhNCZcp0FjpD0jJaVmZXJJpEFxZHI9OTEhMTx5LwEkOC43MvZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxY5NS4jLwQ2MmthNTQyMwBTYWZupzxyMxY1MmphMmYzY3N1qWyxPTYkN2E2NDI1OTtjY2UzY29hqGVhqEZcoGVJZD0jJz1yZGyuUGkurUkcp3RJZD0jJz1yZGyuTGymqEyxPTAzZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MCZwY3BuPTAzY2NjYUNioaNyoaQ9JzNvqXN0ZXI9MTYmNTQkMDx4Mmx4MvZ1nWQ9U2VenW5xo1NQoGF5ZXI2MTquNwQlNWI2MDY1JaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzZzkiYXRTqGF0qXM9ZzFfp2UzZWyxp3A9pHJyYzyx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F6CD 42 B
174 B 44ms
43ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsssVRczS519b6zyaGUXf-Mwxpi5Z2cu4Fvx-ABQ1_niug-2e93zyMe3E1ocbgE3pRrB59exkEz7yPdPNykf15XgG7eH9v8SZaU0JE8t0VJ6uFRayaNwHw&sai=AMfl-YSzc9XogjhzgG7TWYMxPNKEj_xGXjCoPj1BX_hFdq7NeeLtkoq2CeRXl5oFM8a8me85RcWhEBLpe9tmlCnp9jFFDWkcUXRlLx3RMBA8-Nx6dotBxSsiQDyCTfiMojQ&sig=Cg0ArKJSzOFOctzklP_CEAE&cid=CAASFeRoKkB7wxelMnVfSahGM2dFyTGeRQ&id=lidar2&mcvt=1002&p=1110,436,1204,1164&mtos=0,1002,1002,1002,1002&tos=0,1002,0,0,0&v=20211025&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=3023198139&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1635410982431&rpt=709&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bridge3.486.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame CC28 578 KB
190 KB 7ms
6ms Document
text/html 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e8c2a07175788df50b2ce8963f1f28fb6d0f88d26438f10b9575e99f9f4c020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 194260
date: Fri, 22 Oct 2021 01:55:39 GMT
expires: Sat, 22 Oct 2022 01:55:39 GMT
last-modified: Wed, 20 Oct 2021 22:06:14 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 543245
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A04C 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame CC28 156 B
142 B 123ms
122ms XHR
text/xml 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F21734706084%2C22564129828%2Finterpromoteltd&description_url=https%3A%2F%2Ffemme4.com%2F&env=vp&correlator=3667501023747472&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1&unviewed_position_start=1&cust_params=prmsig%3Dmzaqqc&sdkv=h.3.486.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=DE6E02DE-CB87-44AF-8072-88F30F6076FC&eid=420706098&url=https%3A%2F%2Ffemme4.com%2F&dt=1635410984239&cookie=ID%3D088639ec3b077111%3AT%3D1635410982%3AS%3DALNI_MbBMRxdmdAocyfvim_5kbv-YftOIw&scor=2810944670371904&ged=ve4_td2_tt1_pd2_la2000_er119.-2164.272.-1864_vi0.0.1200.1600_vp0_ts1_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:44 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame CE04 7 KB
3 KB 36ms
9ms Script
text/javascript 143.204.98.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=2&w=300&h=600&c=digitas01cont5&js=pmw1&base=te-clr1-1150ff05-c950-4cb5-942b-46bf5a8b7764
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=2&c=digitas01cont5&w=300&h=600
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-23.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: e559d8d2c075f2be9e3afbd45dae899b1f821179386df759b99d8d77b459bc04

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Oct 2021 09:26:34 GMT
content-encoding: gzip
server: nginx
age: 84190
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
content-length: 2470
x-amz-cf-id: r2uh7ObbfKz-acWJ0s-bST6zeVc-E3idbZAOTu7X56EM9-97jO_79Q==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame CE04 38 KB
11 KB 37ms
10ms Script
text/javascript 143.204.98.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=2&w=300&h=600&c=digitas01cont5&js=pmw2
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=2&c=digitas01cont5&w=300&h=600
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-23.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Oct 2021 09:08:06 GMT
content-encoding: gzip
server: nginx
age: 85298
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: _AErqoizVnK_uiE23iwDcYTj8crVQufo4tjeE-XPOpkIU6dd7l11Vg==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame CE04 43 B
383 B 134ms
108ms Image
image/gif 143.204.98.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/cap?aid=hpeus01&pid=digitas01&cid=2&w=300&h=600&c=7244
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-23.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:44 GMT
via: 1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: MNUMea86QIXa2jPTJTnPlfQ6VSEnhL3MVeyCYt21KZhWwlRVanL2Ig==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CE04 42 B
108 B 50ms
49ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstm1CCD5B3uEI1ltlG7m89R19qhFMM4wtM6H_xynLKf0xMaexh8vrrRa1KM1d1qb5xB9_og0LAvOrsxynFwezvknnFdB1IaUOqvjzrCA6gGn-W5PEyyFg&sai=AMfl-YQZbUEvMwoh080mtEqvHDml2Av22HvaX98x3Fjn2oTC443hWKgI0hhiNspPjkArBRcFG8YNiBxbQrN5heYFkqU711bhBBtNtaI21sQg0534wFxplq4d4zTAIzM&sig=Cg0ArKJSzBC6P7c-RZS1EAE&cid=CAASEuRo5mKbRucpMWiQRJV0A46rXg&id=lidar2&mcvt=1001&p=675,1066,1275,1366&mtos=0,106,1001,1001,1001&tos=0,106,895,0,0&v=20211025&bin=7&avms=nio&bs=0,0&mc=0.88&if=1&app=0&itpl=20&adk=647099778&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1635410983289&rpt=226&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame A4BA 7 KB
3 KB 9ms
7ms Script
text/javascript 143.204.98.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=2&w=728&h=90&c=digitas01cont8&js=pmw1&base=te-clr1-8fc07a0b-1ef9-4b8f-88e7-2d6c649c2f10
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=2&c=digitas01cont8&w=728&h=90
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-23.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: d658905e129523f1028ee0fd485e26a7744c4b51bcc20930a8015041e8b0bce8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Oct 2021 09:32:55 GMT
content-encoding: gzip
server: nginx
age: 83809
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
content-length: 2411
x-amz-cf-id: 5Mj0LSQCQu-z7zfR6iWjJmx0_udFbBgQJ7-DavSDkxtXM55aJNV3QA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame A4BA 38 KB
11 KB 11ms
9ms Script
text/javascript 143.204.98.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=2&w=728&h=90&c=digitas01cont8&js=pmw2
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=2&c=digitas01cont8&w=728&h=90
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-23.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Oct 2021 09:09:31 GMT
content-encoding: gzip
server: nginx
age: 85213
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: FurhkHfRG_3zl8jmucdjObMiQBGw3HQ1q7ypcv_PhGIfYyH8LhDOxg==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame A4BA 43 B
384 B 103ms
101ms Image
image/gif 143.204.98.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/cap?aid=hpeus01&pid=digitas01&cid=2&w=728&h=90&c=ce5f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-23.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:44 GMT
via: 1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: BNmVLzyOozk4mu8SOv56eHNubWa28kwZbKKUYle91Q3bpX65CbXbkw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A4BA 42 B
108 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvojv1JAsXwOMy_MHXR2lCvp_-kS0CVG1_R3gClJncY4YZQlpgj05fmeVBA0AfGJuib3PHDOrhs3H-teQl9ZzBPHvhq9Ekc-zGyAV7UdBisb6a581R_mA&sai=AMfl-YSTxDLeRpJIMGh-YRwnC7BNenQi1nHChnHOJoCHQJnFcxE0jhvMWuKTW0oxL2eUAqEyURjSLoZZejImBtnD8YajOIPyhQcPV19u9mYncxkStQfFusdItZsiP10&sig=Cg0ArKJSzJMYmgoTdCcbEAE&cid=CAASEuRofGVESsPKUf0u9Ntwjz4i2g&id=lidar2&mcvt=1000&p=71,436,161,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211025&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2602073323&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1635410983609&rpt=130&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://e6ff1a684e0989bb57ca5a98d283da19.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 326ms
326ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 323ms
323ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 liveView.php
live.primis.tech/live/ 43 B
298 B 20ms
19ms Image
image/gif 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTYzp2VlqzVlVGygZT0kNwM1NDEjOTtkJaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTY0OTE0NwIzrD01NmMzrT0mMwIzoXN0YT0kNTI1MDAkMSZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9ZzVgoWU0LzNioSZxZWJ1Z0yhZz9loWF0nW9hPUFCVCUlMCUlRvUlME1uZ25cqGVCnWRBZGbyMwAyMxYyMwAlJTIjJTJGJTIjMC40JzymQXBjPTAzqXNypxyjQWRxpw05MS4kOTxhMTE4LwplJaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwx1LwAhNDYmOC41NCUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE3YTY0MwU5ODBwZSZlqz49JHgWUF9SVx5sTUFDUx99JzF0qGVgpHRNqWk0nXBfnWVlPTIjJzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2MmU0MTA5ODQ4ODtzqWyxPVNyn2yhZG9TUGkurWVlNwE3YTY0MwVvNwA2NSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:43 GMT
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 / Show response
id.a-mx.com/sync/ 102 B
734 B 68ms
41ms XHR
application/json 2606:4700:3037::ac43:9a47
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.a-mx.com/sync/?tagId=&ref=https://femme4.com/&u=https://femme4.com/&v=5.15.0&vg=pwpbjs&us_privacy=null&gdpr=0&gdpr_consent=
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:9a47 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0038a074c2a5710efac626ae961ab566910e499ed726e21af59858585809f2e

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:45 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET,OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8YfZbe9riVAPdA2HFre7xxB5x9GfmbmGCvSQj9wQwCa%2B8qse4g%2BRXhCkV%2B7ic%2FnaZjescYZXEPsIhRVIXnfhHMSYMiWeGqyql%2FsYjcf3MIBAYZwiib9acC890FI5rGlduDq9x35Yi%2Ffx6A%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: private,max-age=3600
access-control-allow-credentials: true
cf-ray: 6a52e9a10e8b4ec2-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
688 B 34ms
33ms XHR
application/json 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=z9q9llu&fmt=json
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 7113da28669685fc5408ca8d9e966f3dc9d8bead739809b721a80a52e0b6d3cf

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 28 Oct 2021 08:49:45 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Sat, 27 Nov 2021 08:49:45 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 5696 52 KB
17 KB 35ms
6ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Mon, 25 Oct 2021 05:07:02 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 28 Oct 2021 08:49:45 GMT
Age: 13374
X-Served-By: cache-lga21933-LGA, cache-fra19138-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 3, 126603
X-Timer: S1635410985.134316,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame B521 0
0 37ms
13ms Document
text/plain 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13395947
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Server: nginx
Date: Thu, 28 Oct 2021 08:49:45 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap2ams1

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame DD1C 52 KB
17 KB 33ms
6ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Mon, 25 Oct 2021 05:07:02 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 28 Oct 2021 08:49:45 GMT
Age: 13374
X-Served-By: cache-lga21933-LGA, cache-fra19147-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 3, 127945
X-Timer: S1635410985.134377,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame 6397 0
0 38ms
13ms Document
text/plain 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13395947
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Server: nginx
Date: Thu, 28 Oct 2021 08:49:45 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap2ams1

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 2A98 52 KB
17 KB 31ms
7ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Mon, 25 Oct 2021 05:07:02 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 28 Oct 2021 08:49:45 GMT
Age: 13374
X-Served-By: cache-lga21933-LGA, cache-fra19138-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 3, 126604
X-Timer: S1635410985.134425,VS0,VE0
Vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 9EA2 0
0 347ms
111ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP004 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

x-33x-status: 2000208
server: 33XP004
date: Thu, 28 Oct 2021 08:49:44 GMT

GET
H2 200 pd Show response
eu-u.openx.net/w/1.0/ Frame 6EA7 668 B
719 B 23ms
17ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: ff1d52d2354d73d2be259b77dea3d13618fae51d65839830825a5fc06416bf86

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

vary: Accept, Accept-Encoding
server: OXGW/16.217.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 28 Oct 2021 08:49:45 GMT
content-type: text/html
content-length: 418
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 526D 0
0 344ms
111ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP005 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

x-33x-status: 2000208
server: 33XP005
date: Thu, 28 Oct 2021 08:49:45 GMT

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 2D96 0
0 344ms
112ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP001 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

x-33x-status: 2000208
server: 33XP001
date: Thu, 28 Oct 2021 08:49:44 GMT

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 5E2E 0
0 343ms
112ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP003 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

x-33x-status: 2000208
server: 33XP003
date: Thu, 28 Oct 2021 08:49:45 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame AB9B 52 KB
17 KB 28ms
6ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Mon, 25 Oct 2021 05:07:02 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 28 Oct 2021 08:49:45 GMT
Age: 13375
X-Served-By: cache-lga21933-LGA, cache-fra19135-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 3, 127131
X-Timer: S1635410985.137885,VS0,VE0
Vary: Accept-Encoding

GET
H2 200 pd Show response
eu-u.openx.net/w/1.0/ Frame 4ACE 668 B
723 B 17ms
17ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: ff1d52d2354d73d2be259b77dea3d13618fae51d65839830825a5fc06416bf86

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

vary: Accept, Accept-Encoding
server: OXGW/16.217.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 28 Oct 2021 08:49:45 GMT
content-type: text/html
content-length: 418
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 4ACE
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=db50617a-6426-4200-a358-7f8332f459f4

43 B
106 B

17ms
15ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=db50617a-6426-4200-a358-7f8332f459f4
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Thu, 28 Oct 2021 08:49:45 GMT
Server: MT3 4044 0c7f252 master cdg-pixel-x27 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=db50617a-6426-4200-a358-7f8332f459f4
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 28 Oct 2021 08:49:44 GMT

GET p-25CIknq_eSg16.gif
pixel.quantserve.com/pixel/ Frame 4ACE 0
0

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 4ACE
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6286582831658030246

43 B
106 B

15ms
15ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6286582831658030246
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6286582831658030246
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame 4ACE 70 B
264 B 33ms
32ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=8ceae0d9-cd53-74d2-cfe0-a85e75bb3c3e&gdpr=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 4ACE 170 B
188 B 19ms
19ms Image
image/png 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YTA4NTMzMTMtMDQyNC0yYTc2LWRhMDAtZjJlN2JmNTlmMjVl

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 4ACE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEImpV8nIx43VoxxJeczIjUg&google_cver=1

43 B
106 B

16ms
16ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEImpV8nIx43VoxxJeczIjUg&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEImpV8nIx43VoxxJeczIjUg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 6EA7
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=db50617a-6426-4200-a358-7f8332f459f4

43 B
106 B

16ms
15ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=db50617a-6426-4200-a358-7f8332f459f4
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Thu, 28 Oct 2021 08:49:45 GMT
Server: MT3 4044 0c7f252 master cdg-pixel-x29 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=db50617a-6426-4200-a358-7f8332f459f4
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 28 Oct 2021 08:49:44 GMT

GET p-25CIknq_eSg16.gif
pixel.quantserve.com/pixel/ Frame 6EA7 0
0

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 6EA7
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6286582831658030246

43 B
106 B

16ms
16ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6286582831658030246
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6286582831658030246
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame 6EA7 70 B
264 B 32ms
32ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=8ceae0d9-cd53-74d2-cfe0-a85e75bb3c3e&gdpr=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 6EA7 170 B
188 B 18ms
18ms Image
image/png 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YTA4NTMzMTMtMDQyNC0yYTc2LWRhMDAtZjJlN2JmNTlmMjVl

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 6EA7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEImpV8nIx43VoxxJeczIjUg&google_cver=1

43 B
106 B

16ms
16ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEImpV8nIx43VoxxJeczIjUg&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=1
Protocol: H2
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
via: 1.1 google
server: OXGW/16.217.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEImpV8nIx43VoxxJeczIjUg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 5696 0
730 B 10ms
10ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:45 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 44760456-5068-464e-bd50-1de35b97e2ab
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame DD1C 0
730 B 7ms
7ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:45 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b2da90ad-0345-4e5b-8c67-b26bb6744d0a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 2A98 0
730 B 6ms
6ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:45 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b46ebaf0-c06f-4740-883c-2de6523663a7
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame AB9B 0
730 B 10ms
6ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:45 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: da3cb5b0-fcf2-49b2-b417-fc372556c85c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bridge3.486.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame 48E9 578 KB
190 KB 6ms
6ms Document
text/html 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e8c2a07175788df50b2ce8963f1f28fb6d0f88d26438f10b9575e99f9f4c020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 194260
date: Fri, 22 Oct 2021 01:55:39 GMT
expires: Sat, 22 Oct 2022 01:55:39 GMT
last-modified: Wed, 20 Oct 2021 22:06:14 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 543246
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A04C 107 B
165 B 16ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 48E9 156 B
142 B 134ms
133ms XHR
text/xml 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F21734706084%2C22564129828%2Finterpromoteltd&description_url=https%3A%2F%2Ffemme4.com%2F&env=vp&correlator=1325793215807803&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1&unviewed_position_start=1&cust_params=prmsig%3Dmzaqqc&sdkv=h.3.486.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=DE6E02DE-CB87-44AF-8072-88F30F6076FC&eid=420706098&url=https%3A%2F%2Ffemme4.com%2F&dt=1635410985317&cookie=ID%3D088639ec3b077111%3AT%3D1635410982%3AS%3DALNI_MbBMRxdmdAocyfvim_5kbv-YftOIw&scor=2792887883953780&ged=ve4_td3_tt2_pd3_la3000_er119.-2164.272.-1864_vi0.0.1200.1600_vp0_ts1_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:45 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 324ms
323ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 323ms
323ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 5696 0
730 B 16ms
16ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:46 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: fa4d0ec4-b0e1-4184-a03c-8b1e8a01edad
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame DD1C 0
730 B 10ms
9ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:46 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 2d441648-c4d4-4379-889d-5f17cb7dcc28
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 2A98 0
730 B 14ms
13ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:46 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 80c05273-3108-4530-be71-2baaf2411e08
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame AB9B 0
730 B 9ms
9ms Script
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 28 Oct 2021 08:49:46 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 8a31e0fe-0136-449e-a776-9d64f333543f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bridge3.486.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame BCA3 578 KB
190 KB 6ms
6ms Document
text/html 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e8c2a07175788df50b2ce8963f1f28fb6d0f88d26438f10b9575e99f9f4c020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 194260
date: Fri, 22 Oct 2021 01:55:39 GMT
expires: Sat, 22 Oct 2022 01:55:39 GMT
last-modified: Wed, 20 Oct 2021 22:06:14 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 543247
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A04C 107 B
165 B 16ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 liveView.php
live.primis.tech/live/ 43 B
298 B 16ms
16ms Image
image/gif 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTYzp2VlqzVlVGygZT0kNwM1NDEjOTtkJaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTY2MDMkMwYzrD01NmMzrT0mMwIzoXN0YT0kNTI1MDAkMSZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9ZzVgoWU0LzNioSZxZWJ1Z0yhZz9loWF0nW9hPUFCVCUlMCUlRvUlME1uZ25cqGVCnWRBZGbyMwAyMxYyMwAlJTIjJTJGJTIjMC40JzymQXBjPTAzqzyxX2F0nT1coaRypaBlo21iqGVfqGQzqXNypxyjQWRxpw05MS4kOTxhMTE4LwplJaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwx1LwAhNDYmOC41NCUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE3YTY0MwU5ODBwZSZlqz49NTUlMCZuqHRyoXB0TXVfqGyjoGyypw0lMCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0jJzNwpGE9MCZwY3BuQ29hp2VhqD0zY2J1p3Rypw0kNwM1NDEjOTt2MmI3JaVcZD1TZWgcozRiU1BfYXyypwYkN2E2NDI1YwYjNwUzpHVvVXJfPWu0qHBmJTNBJTJGJTJGZzVgoWU0LzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQ=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:45 GMT
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame BCA3 156 B
142 B 134ms
134ms XHR
text/xml 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F21734706084%2C22564129828%2Finterpromoteltd&description_url=https%3A%2F%2Ffemme4.com%2F&env=vp&correlator=3834191950959240&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1&unviewed_position_start=1&cust_params=prmsig%3Dmzaqqc&sdkv=h.3.486.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=DE6E02DE-CB87-44AF-8072-88F30F6076FC&eid=420706098&url=https%3A%2F%2Ffemme4.com%2F&dt=1635410986400&cookie=ID%3D088639ec3b077111%3AT%3D1635410982%3AS%3DALNI_MbBMRxdmdAocyfvim_5kbv-YftOIw&scor=567845491906772&ged=ve4_td4_tt3_pd4_la4000_er119.-2164.272.-1864_vi0.0.1200.1600_vp0_ts1_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:46 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 320ms
319ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 318ms
318ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 liveView.php
live.primis.tech/live/ 43 B
298 B 17ms
17ms Image
image/gif 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTYzp2VlqzVlVGygZT0kNwM1NDEjOTtkJaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTE2MwM4NTpzrD01NmMzrT0mMwIzoXN0YT0kNTI1MDAkMSZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9ZzVgoWU0LzNioSZxZWJ1Z0yhZz9loWF0nW9hPUFCVCUlMCUlRvUlME1uZ25cqGVCnWRBZGbyMwAyMxYyMwAlJTIjJTJGJTIjMC40JzymQXBjPTAzqXNypxyjQWRxpw05MS4kOTxhMTE4LwplJaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwx1LwAhNDYmOC41NCUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE3YTY0MwU5ODBwZSZlqz49JHgWUF9SVx5sTUFDUx99JzF0qGVgpHRNqWk0nXBfnWVlPTIjJzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2MmU0MTA5ODpjNwAzqWyxPVNyn2yhZG9TUGkurWVlNwE3YTY0MwVvNwA2NSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:46 GMT
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bridge3.486.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame 7F4D 578 KB
190 KB 6ms
6ms Document
text/html 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e8c2a07175788df50b2ce8963f1f28fb6d0f88d26438f10b9575e99f9f4c020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 194260
date: Fri, 22 Oct 2021 01:55:39 GMT
expires: Sat, 22 Oct 2022 01:55:39 GMT
last-modified: Wed, 20 Oct 2021 22:06:14 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 543248
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A04C 107 B
165 B 16ms
16ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 7F4D 156 B
142 B 148ms
148ms XHR
text/xml 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F21734706084%2C22564129828%2Finterpromoteltd&description_url=https%3A%2F%2Ffemme4.com%2F&env=vp&correlator=2520424609208299&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1&unviewed_position_start=1&cust_params=prmsig%3Dmzaqqc&sdkv=h.3.486.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=DE6E02DE-CB87-44AF-8072-88F30F6076FC&eid=420706098&url=https%3A%2F%2Ffemme4.com%2F&dt=1635410987480&cookie=ID%3D088639ec3b077111%3AT%3D1635410982%3AS%3DALNI_MbBMRxdmdAocyfvim_5kbv-YftOIw&scor=4138981197005528&ged=ve4_td5_tt4_pd5_la5000_er119.-2164.272.-1864_vi0.0.1200.1600_vp0_ts1_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 325ms
324ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A04C 0
211 B 215ms
214ms XHR
application/json 18.195.244.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.5.18.0_1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.244.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-244-174.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 liveView.php
live.primis.tech/live/ 43 B
298 B 16ms
16ms Image
image/gif 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTYzp2VlqzVlVGygZT0kNwM1NDEjOTtkJaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTY0OTE0NwIzrD01NmMzrT0mMwIzoXN0YT0kNTI1MDAkMSZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9ZzVgoWU0LzNioSZxZWJ1Z0yhZz9loWF0nW9hPUFCVCUlMCUlRvUlME1uZ25cqGVCnWRBZGbyMwAyMxYyMwAlJTIjJTJGJTIjMC40JzymQXBjPTAzqXNypxyjQWRxpw05MS4kOTxhMTE4LwplJaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwx1LwAhNDYmOC41NCUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE3YTY0MwU5ODBwZSZlqz49JHgWUF9SVx5sTUFDUx99JzF0qGVgpHRNqWk0nXBfnWVlPTIjJzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2MmU0MTA5ODtkNTYzqWyxPVNyn2yhZG9TUGkurWVlNwE3YTY0MwVvNwA2NSZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 28 Oct 2021 08:49:48 GMT
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

user
ads3.admatic.com.tr/ Frame CB79
Redirect Chain

https://x.bidswitch.net/sync?ssp=admatic
https://ws.rqtrk.eu/pull?redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D193%26user_id%3D%24BROWSER_ID%26expires%3D1%26ssp%3D%24bidswitch_ssp_id&return-unstable=true&eb=&bidswitch_ssp_id=a...
https://x.bidswitch.net/sync?dsp_id=193&user_id=&expires=1&ssp=admatic
https://ads4.admatic.com.tr/showad/px/ums/sync/bsw?bsw_uuid=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627&dsp_uuid=&dsp_id=
https://ads3.admatic.com.tr/user?bsw_uuid=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627&dsp_uuid=&dsp_id=

35 B
71 B

48ms
48ms

Image
image/gif

188.132.147.228
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads3.admatic.com.tr/user?bsw_uuid=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627&dsp_uuid=&dsp_id=
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 08:49:48 GMT
server: AdMatic
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
x-powered-by: AdMatic
content-type: image/gif
cache-control: no-cache
timing-allow-origin: *
content-length: 35

Redirect headers

timing-allow-origin: *
date: Thu, 28 Oct 2021 08:49:48 GMT
location: https://ads3.admatic.com.tr/user?bsw_uuid=a9b29ad6-61ff-4dc0-a6b6-c9fce8092627&dsp_uuid=&dsp_id=
x-powered-by: AdMatic
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: text/html; charset=utf-8
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
content-length: 221

GET
H2 200 bridge3.486.2_en.html Show response
imasdk.googleapis.com/js/core/ Frame 41A6 578 KB
190 KB 6ms
6ms Document
text/html 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e8c2a07175788df50b2ce8963f1f28fb6d0f88d26438f10b9575e99f9f4c020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 194260
date: Fri, 22 Oct 2021 01:55:39 GMT
expires: Sat, 22 Oct 2022 01:55:39 GMT
last-modified: Wed, 20 Oct 2021 22:06:14 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 543249
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET integrator.js
adservice.google.com/adsid/ Frame A04C 0
0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 41A6 156 B
142 B 132ms
132ms XHR
text/xml 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F21734706084%2C22564129828%2Finterpromoteltd&description_url=https%3A%2F%2Ffemme4.com%2F&env=vp&correlator=4316019412139940&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1&unviewed_position_start=1&cust_params=prmsig%3Dmzaqqc&sdkv=h.3.486.2&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=DE6E02DE-CB87-44AF-8072-88F30F6076FC&eid=420706098&url=https%3A%2F%2Ffemme4.com%2F&dt=1635410988580&cookie=ID%3D088639ec3b077111%3AT%3D1635410982%3AS%3DALNI_MbBMRxdmdAocyfvim_5kbv-YftOIw&scor=3009323078128956&ged=ve4_td7_tt6_pd7_la7000_er119.-2164.272.-1864_vi0.0.1200.1600_vp0_ts2_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.486.2_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS