www.mazhuren.com Open in urlscan Pro
43.138.202.7 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.mazhuren.com/saoma/
Submission: On November 27 via api (November 27th 2023, 5:06:01 am UTC) from US — Scanned from DE

Summary HTTP 111 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 23 IPs in 8 countries across 24 domains to perform 111 HTTP transactions. The main IP is 43.138.202.7, located in China and belongs to TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN. The main domain is www.mazhuren.com.
TLS certificate: Issued by R3 on October 5th 2023. Valid for: 3 months.

This is the only time www.mazhuren.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
15	43.138.202.7 43.138.202.7	45090 (TENCENT-N...) (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited)
22	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
1 12	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
17	2a00:1450:400... 2a00:1450:4001:802::2001	15169 (GOOGLE) (GOOGLE)
1 1	52.26.40.192 52.26.40.192	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223f:fc00:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
2	103.235.46.191 103.235.46.191	55967 (BAIDU Bei...) (BAIDU Beijing Baidu Netcom Science and Technology Co.)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
3 11	216.58.206.34 216.58.206.34	15169 (GOOGLE) (GOOGLE)
2 4	172.64.151.101 172.64.151.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3	185.89.210.101 185.89.210.101	29990 (ASN-APPNEX) (ASN-APPNEX)
7	2a00:1450:400... 2a00:1450:4001:831::2006	15169 (GOOGLE) (GOOGLE)
2 4	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
2	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1 2	54.73.183.248 54.73.183.248	16509 (AMAZON-02) (AMAZON-02)
1	85.14.248.71 85.14.248.71	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2 2	3.69.152.80 3.69.152.80	16509 (AMAZON-02) (AMAZON-02)
1 1	34.91.62.186 34.91.62.186	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
1 1	85.114.159.118 85.114.159.118	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
2 2	37.157.6.232 37.157.6.232	198622 (ADFORM) (ADFORM)
2 2	213.155.156.169 213.155.156.169	1299 (TWELVE99 ...) (TWELVE99 Arelion)
1	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
2	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
111	23

15 43.138.202.7 (China)

ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN)

www.mazhuren.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.26.40.192 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-26-40-192.us-west-2.compute.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223f:fc00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 103.235.46.191 (Hong Kong)

ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN)

hm.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 216.58.206.34 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: lcfraa-aa-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.64.151.101 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.101 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:831::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.73.183.248 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-73-183-248.eu-west-1.compute.amazonaws.com

skydeutschland.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.14.248.71 (Neukirchen-Vluyn, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)

m.exactag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.69.152.80 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-69-152-80.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.91.62.186 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 186.62.91.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.118 (Loerrach, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.6.232 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.155.156.169 (Sweden) 2 redirects

ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE)

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.74.194 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 97 tpc.googlesyndication.com — Cisco Umbrella Rank: 149	463 KB
25	doubleclick.net 4 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 cm.g.doubleclick.net — Cisco Umbrella Rank: 245 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 439	158 KB
15	mazhuren.com www.mazhuren.com	198 KB
7	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 300	270 KB
7	gstatic.com www.gstatic.com fonts.gstatic.com	74 KB
4	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 2	833 B
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 625	2 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 246	2 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 212	191 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	4 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 145
2	de17a.com 2 redirects d5p.de17a.com — Cisco Umbrella Rank: 4905	653 B
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 599	1 KB
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 912	2 KB
2	demdex.net 1 redirects skydeutschland.demdex.net — Cisco Umbrella Rank: 131194	1 KB
2	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2462	309 B
2	baidu.com hm.baidu.com — Cisco Umbrella Rank: 9830	12 KB
2	adsafeprotected.com 1 redirects pixel.adsafeprotected.com — Cisco Umbrella Rank: 736 static.adsafeprotected.com — Cisco Umbrella Rank: 587	705 B
1	travelaudience.com 1 redirects ads.travelaudience.com — Cisco Umbrella Rank: 5683	554 B
1	adition.com 1 redirects dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1533	587 B
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 353	149 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 795	716 B
1	exactag.com m.exactag.com — Cisco Umbrella Rank: 11905	1 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	91 KB
111	24

	Domain	Requested by
22	pagead2.googlesyndication.com	www.mazhuren.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
17	tpc.googlesyndication.com	googleads.g.doubleclick.net www.mazhuren.com tpc.googlesyndication.com pagead2.googlesyndication.com
15	www.mazhuren.com	www.mazhuren.com
12	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com www.mazhuren.com googleads.g.doubleclick.net
11	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net www.mazhuren.com
7	s0.2mdn.net	www.mazhuren.com s0.2mdn.net
6	www.gstatic.com	googleads.g.doubleclick.net
4	www.google.com	2 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	www.googletagservices.com	www.mazhuren.com googleads.g.doubleclick.net
3	fonts.googleapis.com	googleads.g.doubleclick.net
2	www.googleadservices.com	www.mazhuren.com
2	d5p.de17a.com	2 redirects
2	c1.adform.net	2 redirects
2	pm.w55c.net	2 redirects
2	skydeutschland.demdex.net	1 redirects googleads.g.doubleclick.net
2	googleads4.g.doubleclick.net	www.mazhuren.com
2	region1.google-analytics.com	www.googletagmanager.com
2	hm.baidu.com	www.mazhuren.com
1	fonts.gstatic.com	fonts.googleapis.com
1	ads.travelaudience.com	1 redirects
1	dsp.adfarm1.adition.com	1 redirects
1	match.adsrvr.org	googleads.g.doubleclick.net
1	um.simpli.fi	1 redirects
1	m.exactag.com	googleads.g.doubleclick.net
1	static.adsafeprotected.com	googleads.g.doubleclick.net
1	pixel.adsafeprotected.com	1 redirects
1	www.googletagmanager.com	www.mazhuren.com
111	29

This site contains links to these domains. Also see Links.

Domain
mazhuren.com
ip38.com
tool.ip38.com
filehelper.weixin.qq.com

Subject Issuer	Validity	Valid
mazhuren.com R3	`2023-10-05` - `2024-01-03`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
baidu.com GlobalSign RSA OV SSL CA 2018	`2023-07-06` - `2024-08-06`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.exactag.com Sectigo ECC Domain Validation Secure Server CA	`2023-08-22` - `2024-09-15`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 18 frames:

Primary Page: https://www.mazhuren.com/saoma/
Frame ID: 1282DE5E6A43A9B34BFCA4F13238DCBB
Requests: 27 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20190131/zrt_lookup_fy2021.html
Frame ID: 0B98B7B922F31E9D3DDD6043C59CB28B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7578658000090989&output=html&adk=1812271804&adf=3025194257&lmt=1696696072&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~5~6&ascmds=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701061555172&bpp=7&bdt=239&idt=253&shv=r20231109&mjsv=m202311090101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6430449762534&frm=20&pv=2&ga_vid=1535369883.1701061555&ga_sid=1701061555&ga_hid=608285011&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079265%2C31078297%2C44807764%2C44808149%2C44808285%2C44809057&oid=2&pvsid=1389033803679421&tmod=336585411&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=267
Frame ID: 289C6FE7C9D806E2B572503524259880
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 28B7BC71B02BD7809F110D3B34F556A3
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 02E3DB393BC4FBEB0FFFBFF596F12D34
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbFnv0BMAE&v=APEucNXNS95NIGBw3lPl6dPGSsUIE1UTo2oz8Itv8Nl3KzgMlcE11LGClCLIxMyX8KqtI-Tnsr3m1gWlxHJuBkLSAY6bR_FTZvkSF2AvIuTNoFqwuvlgJ4iWMnImW8ZDB7Q9T5ObU44ilbB2rQCsafBPhvI5Ysx1L_yD_tcmwXrTfk6g4-oBgxw
Frame ID: D1C474F872AEC665ACBC16A5227DB587
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: A26ABEDE3D6AB3875DDF8464FCE279F4
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7578658000090989&output=html&h=280&slotname=1164531029&adk=2361666189&adf=3485704032&pi=t.ma~as.1164531029&w=956&fwrn=4&fwrnh=100&lmt=1696696072&rafmt=1&format=956x280&url=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701061556453&bpp=1&bdt=1520&idt=1&shv=r20231109&mjsv=m202311090101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1600x1200%2C728x90&nras=3&correlator=6430449762534&frm=20&pv=1&ga_vid=1535369883.1701061555&ga_sid=1701061555&ga_hid=608285011&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=322&ady=173&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079265%2C31078297%2C44807764%2C44808149%2C44808285%2C44809057&oid=2&pvsid=1389033803679421&tmod=336585411&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&dtd=4
Frame ID: 59CCDF737C57FFA0856236EBFCCE38AE
Requests: 15 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: EB43255F6FD6F8C265AFF31FAF5BDE6C
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: B2003E9A5DD6683048FE3C1BC575CE32
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 580448B9F70AAABC3357EA75CEF6189A
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250
Frame ID: 4D23FE13D17E7408C5D247C9BC4B0E44
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/6h7OZzYWuChAMW0yNvwaAqN_brH89lOBLHEXo8EbMVo.js
Frame ID: BDA6BF58CBB081E9F936B7EA0D878FDE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: F33F0FF77ACF5FC60BDAC6E22CEDA8B3
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F7A9912B5199D237838290AA87F9E0E8
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/6h7OZzYWuChAMW0yNvwaAqN_brH89lOBLHEXo8EbMVo.js
Frame ID: C8783968D5AA1035B3C6D2C8EC431F40
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 494BE6653FCE2D94D08C9BCB5040FF7D
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 08A3C7A3F7358AC8E7B855C4ABFC6BF2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

在线二维码扫描

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Baidu Analytics (百度统计) (Analytics) Expand

Overall confidence: 100%
Detected patterns

hm\.baidu\.com/hm\.js

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

111
Requests

88 %
HTTPS

41 %
IPv6

24
Domains

29
Subdomains

23
IPs

8
Countries

1467 kB
Transfer

3973 kB
Size

29
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://mazhuren.com/
Title: 二维码生成器

Search URL Search Domain Scan URL

URL: https://ip38.com/
Title: 更多工具

Search URL Search Domain Scan URL

URL: https://mazhuren.com/saoma/
Title: 在线扫描二维码

Search URL Search Domain Scan URL

URL: https://tool.ip38.com/barcode/
Title: 条形码生成器

Search URL Search Domain Scan URL

URL: https://filehelper.weixin.qq.com/
Title: 微信扫码传文件网页版

Search URL Search Domain Scan URL

URL: https://mazhuren.com/bin.png
Title: 联系

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

https://pixel.adsafeprotected.com/rfw/st/1676726/76430589/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1014760199&ias_pubId=pub-7578658000090989&ias_chanId=1&ias_placementId=20761493732&bidurl=https://www.mazhuren.com/saoma/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gO3COLRVxzXqxQ7J37RLsk HTTP 302
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=

Request Chain 38

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECGTpueHsosFsZEThnUG8zg&google_cver=1

Request Chain 39

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWQjtNgpFFBbLDhZkwq7PwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECGTpueHsosFsZEThnUG8zg&google_cver=1

Request Chain 40

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEGosxgoQMmHlu758lL_pg5E&google_cver=1

Request Chain 41

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUyODExMTEzNjYxNjk4Nzg5Mw%3D%3D

Request Chain 58

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 63

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=205036047&d_placement=380833143&d_campaign=30999372&d_bust=3793360539&gdpr=&gdpr_consent= HTTP 302
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=205036047&d_placement=380833143&d_campaign=30999372&d_bust=3793360539&gdpr=&gdpr_consent=

Request Chain 82

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBOQjl9ZmbNswCypsUzqQfY&google_cver=1&google_push=AXcoOmS298nbmYucO_pcNmy0-IhoarWQaFOWQ-4AJ_bwK2AtMzsfqGwm0rLWb-1NiCyNpe-qJJWPzDWk46xtejADuhnBNaUEewF6zsc HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBOQjl9ZmbNswCypsUzqQfY&google_cver=1&google_push=AXcoOmS298nbmYucO_pcNmy0-IhoarWQaFOWQ-4AJ_bwK2AtMzsfqGwm0rLWb-1NiCyNpe-qJJWPzDWk46xtejADuhnBNaUEewF6zsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=UFdjTnJsaDIxUjd0T0o1&google_gid=CAESEBOQjl9ZmbNswCypsUzqQfY&google_cver=1&google_push=AXcoOmS298nbmYucO_pcNmy0-IhoarWQaFOWQ-4AJ_bwK2AtMzsfqGwm0rLWb-1NiCyNpe-qJJWPzDWk46xtejADuhnBNaUEewF6zsc

Request Chain 83

https://um.simpli.fi/gp_match?google_gid=CAESEHy5CgmE0lDoMlZfy2uQ_bE&google_cver=1&google_push=AXcoOmTi6epZ3RCaRLfuzJL-2p5-OXd-7Oe96CzBTnfk_qaw2Bc-TMtrKu8MV-JjyHcliaEoA4HAvQx4ia_xXXhBkf01wixX-9fiaCk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=0D2066A7C92F42E3AE7D59D4B7D0C614&google_push=AXcoOmTi6epZ3RCaRLfuzJL-2p5-OXd-7Oe96CzBTnfk_qaw2Bc-TMtrKu8MV-JjyHcliaEoA4HAvQx4ia_xXXhBkf01wixX-9fiaCk

Request Chain 85

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEOG-jsyRjgfwgzAqUXWkU5w&google_cver=1&google_push=AXcoOmQNPkKlqM76u9OG8XOjOd3dsbL4HZfEWqNyZcy_iDcZBDgq3xjfxqIE1UPwObQAyLFDLmmKftfWLlW2QZh9gXarXWxTYzdLVlc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjAwMzc1NTgwNjA5NTUxMg%3D%3D&google_push=AXcoOmQNPkKlqM76u9OG8XOjOd3dsbL4HZfEWqNyZcy_iDcZBDgq3xjfxqIE1UPwObQAyLFDLmmKftfWLlW2QZh9gXarXWxTYzdLVlc

Request Chain 86

https://ads.travelaudience.com/google_pixel?google_gid=CAESEJtCOgR0wcHSae6cZat4UDk&google_cver=1&google_push=AXcoOmRgvJeAdwT4W3oMZXuxpghbqF6og6mL48_jF1Bu5e-XwBlrsEzlg9XMfVuRYHHtK_BvNlxVskpce-nI57QCZxGY84BIYZ7alzs HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=W9XrwCQBQ48rwKnk8dT27Q&google_push=AXcoOmRgvJeAdwT4W3oMZXuxpghbqF6og6mL48_jF1Bu5e-XwBlrsEzlg9XMfVuRYHHtK_BvNlxVskpce-nI57QCZxGY84BIYZ7alzs

Request Chain 87

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEK5nSoad4NuNo9vei8mdY-Q&google_cver=1&google_push=AXcoOmQG5RFx0Nic3ex43y27iFWAeZprEnn5bH5IBHtPTa8NpDzzhj_ipJyuDTcmsslieFxPSJYzqtyWul1LM8AD7qQmgfceQDFK0Oc HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEK5nSoad4NuNo9vei8mdY-Q&google_cver=1&google_push=AXcoOmQG5RFx0Nic3ex43y27iFWAeZprEnn5bH5IBHtPTa8NpDzzhj_ipJyuDTcmsslieFxPSJYzqtyWul1LM8AD7qQmgfceQDFK0Oc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODk1MzgxNTg4OTAzMDA4OTA1NQ&google_push=AXcoOmQG5RFx0Nic3ex43y27iFWAeZprEnn5bH5IBHtPTa8NpDzzhj_ipJyuDTcmsslieFxPSJYzqtyWul1LM8AD7qQmgfceQDFK0Oc

Request Chain 88

https://d5p.de17a.com/cookies/google?google_gid=CAESEE8eDTD4MdNHwDmJFk0yDds&google_cver=1&google_push=AXcoOmSxHxoEsrl-4LnLrE7ogd58fjnKKfQO1c1Ir3Pad0Un6tE9kVx7fN6hcvygl3OE9pzTZrjWmpNBvEet_McDwGkfLnoXGFlv4Cw HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEE8eDTD4MdNHwDmJFk0yDds&google_cver=1&google_push=AXcoOmSxHxoEsrl-4LnLrE7ogd58fjnKKfQO1c1Ir3Pad0Un6tE9kVx7fN6hcvygl3OE9pzTZrjWmpNBvEet_McDwGkfLnoXGFlv4Cw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSxHxoEsrl-4LnLrE7ogd58fjnKKfQO1c1Ir3Pad0Un6tE9kVx7fN6hcvygl3OE9pzTZrjWmpNBvEet_McDwGkfLnoXGFlv4Cw

Request Chain 90

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 94

https://googleads.g.doubleclick.net/pagead/adview?ai=CtI4vtCNkZaqrHoTa1fAPuIKM-A_Y_92OdM_Q4e7REqqXwPzrAhABIPq6zQVglZKggrAHoAHI-6n0AsgBAakCB8Q0K5Nasj6oAwHIA8MEqgTrAU_Q-yzC1AWIemHSIZtDC9oNJCCK2e3fp0wGJAcD1pRyeidzS0VemjuNNvq7EZAprQ3HsfMKuiLcRaBPfG9XIdaCVVbUivJiXBLn2-nDgvjQRt0uHtrsNzPg5uKoLRgBdU_Okg8VOtPXxdQ0mbFuxrx76spncfmIDpEoZveKbC68pVOWrrkmbJcVVpxmEbzajzjED3WUN-R2g3L5DKupSyGVV9w6M5h4QfxTI0FbnKpEZMQhBmhpbxvVsypUO01PIUCFly0WYM5JXv6U6p4gWvcRhKPHbUkiYMRJcm5UqYztIssklM9KwiJbRwrABMbt_sC8BIgFvPGnlU2SBQQIBBgBkgUECAUYBKAGZoAHoITWiwGoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBRCvvMgB0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOpoJH2h0dHBzOi8vd3d3Lm1vZ2hhZGRhbS1ncm9vcy5kZS-ACgHICwGiDBwqGgoY5LSxAu61sQK1uLEC5LSxAu61sQKsurEC2BMK0BUBgBcBshccChoIABIUcHViLTc1Nzg2NTgwMDAwOTA5ODkYAA&sigh=pjKYNf1LO68&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSOwDICaaNd6a6LfrW30q5Bomno-2RUqIAB9ULCX_nt5_-9B0s25BM6tD1hOaMpG6u3xXzcany8ajKpCQfGAE&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229318104440848011767%22,%22debug_reporting%22:true,%22destination%22:%22https://moghaddam-groos.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22780828104%22],%224%22:[%2211-27%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221535355331831839409%22}&andc=true

111 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.mazhuren.com/saoma/ 8 KB
3 KB 17955ms
786ms Document
text/html 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

1b76e0a988eae1a40da171370e2da701669279ce2c241d3fd3ec16cf59e2b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-type: text/html
date: Mon, 27 Nov 2023 05:05:54 GMT
etag: W/"65218708-1e6d"
expires: Wed, 29 Nov 2023 05:05:54 GMT
last-modified: Sat, 07 Oct 2023 16:27:52 GMT
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 app.css
www.mazhuren.com/saoma/assets/ 14 KB
4 KB 1513ms
1513ms Stylesheet
text/css 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mazhuren.com/saoma/assets/app.css?v2622

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

bfb8a517fb615642b5de366c25626aaa92b7424a8a52389a0f1f73de7a66ae8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Sat, 07 Oct 2023 16:26:32 GMT
server: nginx
etag: W/"652186b8-38e6"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 addtohomescreen.css
www.mazhuren.com/saoma/addtohome/ 10 KB
4 KB 1514ms
1513ms Stylesheet
text/css 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mazhuren.com/saoma/addtohome/addtohomescreen.css?vd30dd2

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

6f1e76c4460d6cfdefa19393f5e03f009f873fccb275686da46b7268513a1ee7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Thu, 31 Aug 2023 13:51:40 GMT
server: nginx
etag: W/"64f09aec-2934"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 hqr.js Show response
www.mazhuren.com/saoma/assets/ 388 KB
125 KB 2020ms
2018ms Script
application/javascript 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mazhuren.com/saoma/assets/hqr.js?v2603

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

2c69b6e5600a9d60ec95edbf3fbddda0fcac1db80f196cea632f39e01c1b5ef1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Thu, 31 Aug 2023 03:46:23 GMT
server: nginx
etag: W/"64f00d0f-60e84"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 copy.svg
www.mazhuren.com/saoma/assets/images/ 1 KB
1 KB 2020ms
2019ms Image
image/svg+xml 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/images/copy.svg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

b6790f038a116231111ed8cc8d3f11c49ce489f773292246d5f964cadefd4e52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 29 Aug 2023 05:26:16 GMT
server: nginx
etag: "64ed8178-466"
content-type: image/svg+xml
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1126
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 coin.svg
www.mazhuren.com/saoma/assets/images/ 2 KB
2 KB 2020ms
2019ms Image
image/svg+xml 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/images/coin.svg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

c22f74d5ba1997268730300b7d6f6b971f2926cdebd598c77bed9c75369a0f0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 29 Aug 2023 05:26:49 GMT
server: nginx
etag: "64ed8199-6de"
content-type: image/svg+xml
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1758
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 link2.svg
www.mazhuren.com/saoma/assets/images/ 745 B
954 B 2020ms
2019ms Image
image/svg+xml 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/images/link2.svg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

8afed81427b3eb5fd11c2528d9fd91151a2831a2b8c0011b5749b0722f1cd9bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 29 Aug 2023 05:28:23 GMT
server: nginx
etag: "64ed81f7-2e9"
content-type: image/svg+xml
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 745
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 download.svg
www.mazhuren.com/saoma/assets/images/ 723 B
932 B 2020ms
2019ms Image
image/svg+xml 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/images/download.svg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

ab80efd0f585e682a41f65cb5e98f66e6243a361ff2b8c1cf84042d612968e88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 29 Aug 2023 05:28:07 GMT
server: nginx
etag: "64ed81e7-2d3"
content-type: image/svg+xml
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 723
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 newqr.svg
www.mazhuren.com/saoma/assets/images/ 924 B
1 KB 2020ms
2019ms Image
image/svg+xml 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/images/newqr.svg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

c8fdf4cefefc7983b2ba46a8c151d2234b5149a19386ccadf52561c9c679ef14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Sat, 26 Aug 2023 14:11:47 GMT
server: nginx
etag: "64ea0823-39c"
content-type: image/svg+xml
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 924
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 150 KB
52 KB 151ms
63ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7578658000090989

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac73ebb8340b0f556f027e5480f87e9783cbacceb229f967de67ad213c4b4b6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mazhuren.com/
Origin: https://www.mazhuren.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52822
x-xss-protection: 0
server: cafe
etag: 6698532597703388091
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 27 Nov 2023 05:05:55 GMT

GET
H2 200 coffee.svg
www.mazhuren.com/saoma/assets/images/icons/ 2 KB
3 KB 1772ms
1772ms Image
image/svg+xml 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/images/icons/coffee.svg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

1c79f82b01a2b1b3df124744176b8ab0ef7879acf39c1ce38fb30172edcb9c92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 23 Aug 2023 07:22:07 GMT
server: nginx
etag: "64e5b39f-9e4"
content-type: image/svg+xml
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2532
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 qr.svg
www.mazhuren.com/saoma/assets/images/icons/ 2 KB
2 KB 1773ms
1773ms Image
image/svg+xml 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/images/icons/qr.svg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

c2e5bfc0e640e9209a63e4e1beffbd68b964b0e101a2774d28b2dff751df7638

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 23 Aug 2023 07:18:56 GMT
server: nginx
etag: "64e5b2e0-684"
content-type: image/svg+xml
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1668
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 menu.svg
www.mazhuren.com/saoma/assets/images/icons/ 1 KB
1 KB 1758ms
1757ms Image
image/svg+xml 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/images/icons/menu.svg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

c017841da21bf961e1aa94d3d8b262fc6e1069e4b20dfc22e35d9ade616f2175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 23 Aug 2023 07:16:41 GMT
server: nginx
etag: "64e5b259-4f4"
content-type: image/svg+xml
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1268
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 saoma.svg
www.mazhuren.com/saoma/assets/svg/ 3 KB
3 KB 2020ms
2019ms Image
image/svg+xml 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/svg/saoma.svg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

6daac2b50fbb9e55294bf625ab0586b2c7f968de85f30fc288dcea094781d68d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 24 Aug 2023 10:07:32 GMT
server: nginx
etag: "64e72be4-b43"
content-type: image/svg+xml
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 2883
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 zf.png
www.mazhuren.com/saoma/assets/svg/ 35 KB
35 KB 1759ms
1757ms Image
image/png 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mazhuren.com/saoma/assets/svg/zf.png

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

e64458939113a2bc723bfbb8b11912c876d9139ae95ed113f590b1b7fac50417

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 24 Aug 2023 14:20:13 GMT
server: nginx
etag: "64e7671d-8ae7"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 35559
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 274 KB
91 KB 141ms
54ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ME9H8EJXQD

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2b4111b56611f39e790138bb704e4951d9d38393f432e696b1939a523d78dec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92871
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 27 Nov 2023 05:05:55 GMT

GET
H2 200 addtohomescreen.js Show response
www.mazhuren.com/saoma/addtohome/ 32 KB
11 KB 2020ms
2018ms Script
application/javascript 43.138.202.7
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mazhuren.com/saoma/addtohome/addtohomescreen.js?dd8s533d03d33df

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

43.138.202.7 , China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

dea253b8b5f9d27bf5fbaa76c913061d6d7970e113d4f516bad3bf88f80c7b23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/saoma/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Tue, 05 Sep 2023 09:27:28 GMT
server: nginx
etag: W/"64f6f480-7f9c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
expires: Wed, 27 Dec 2023 05:05:56 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311090101/ 400 KB
135 KB 155ms
75ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311090101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7578658000090989&plah=www.mazhuren.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7578658000090989

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf1e27c97e82ceea7beb915ab5aad237dd01e7f4d96dd4a1d08b10fccd98fd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138528
x-xss-protection: 0
server: cafe
etag: 18010323439575903949
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 27 Nov 2023 05:05:55 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20190131/ Frame 0B98 9 KB
4 KB 125ms
39ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7578658000090989

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mazhuren.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 46071
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 16:18:04 GMT
etag: 16674218716276178799
expires: Sun, 10 Dec 2023 16:18:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 289C 230 KB
61 KB 808ms
807ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7578658000090989&output=html&adk=1812271804&adf=3025194257&lmt=1696696072&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~5~6&ascmds=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701061555172&bpp=7&bdt=239&idt=253&shv=r20231109&mjsv=m202311090101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6430449762534&frm=20&pv=2&ga_vid=1535369883.1701061555&ga_sid=1701061555&ga_hid=608285011&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079265%2C31078297%2C44807764%2C44808149%2C44808285%2C44809057&oid=2&pvsid=1389033803679421&tmod=336585411&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=267

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311090101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7578658000090989&plah=www.mazhuren.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d78ca8bcf83495055bf385f07c42b29d794c260521c2f64ff1ef1207c4b0cf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mazhuren.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 61770
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 05:05:56 GMT
expires: Mon, 27 Nov 2023 05:05:56 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311090101/ 160 KB
55 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311090101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9112244cbbfad4bc13571966529c8e0190383351ee91b47a9806c4f0d8678234

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55806
x-xss-protection: 0
server: cafe
etag: 8124921421164124137
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Nov 2023 05:05:56 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/ Frame 28B7 9 KB
4 KB 39ms
39ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mazhuren.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 29739
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 20:50:17 GMT
etag: 16674218716276178799
expires: Sun, 10 Dec 2023 20:50:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/ Frame 02E3 9 KB
4 KB 39ms
39ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mazhuren.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 29739
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 20:50:17 GMT
etag: 16674218716276178799
expires: Sun, 10 Dec 2023 20:50:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 28B7 4 KB
1 KB 136ms
50ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 27 Nov 2023 05:05:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 03:42:27 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Nov 2023 05:05:56 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 28B7 205 B
651 B 125ms
39ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:42:07 GMT
x-content-type-options: nosniff
age: 509029
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 20 Nov 2024 07:42:07 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 28B7 604 B
695 B 126ms
40ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 12:20:23 GMT
x-content-type-options: nosniff
age: 60333
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 25 Nov 2024 12:20:23 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 28B7 15 KB
7 KB 141ms
54ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2881d8eadc298102d2462e8d32e40792adce37b6cd89d99045f574eb3ecbb748

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 07:40:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77127
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6702
x-xss-protection: 0
server: cafe
etag: 11213825687312121238
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 07:40:29 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 28B7 21 KB
9 KB 133ms
47ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25b1b4e9934aa4cb8e8bdf5fd7911f6ec67acde6b6b39f1561aec2244f7826af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8781
x-xss-protection: 0
server: cafe
etag: 9666818975682992898
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D1C4 624 B
246 B 52ms
52ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbFnv0BMAE&v=APEucNXNS95NIGBw3lPl6dPGSsUIE1UTo2oz8Itv8Nl3KzgMlcE11LGClCLIxMyX8KqtI-Tnsr3m1gWlxHJuBkLSAY6bR_FTZvkSF2AvIuTNoFqwuvlgJ4iWMnImW8ZDB7Q9T5ObU44ilbB2rQCsafBPhvI5Ysx1L_yD_tcmwXrTfk6g4-oBgxw

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 05:05:56 GMT
expires: Mon, 27 Nov 2023 05:05:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A26A 89 KB
31 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf940bd2489897434455528323cf66c4e3aecd5eea963f1d99d96acd452d6dd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31498
x-xss-protection: 0
server: cafe
etag: 4296746511219988724
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Mon, 27 Nov 2023 05:05:56 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame A26A
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/1676726/76430589/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1014760199&ias_pubId=pub-7578658000090989&ias_chanId=1&ias_place...
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=

43 B
482 B

145ms
39ms

Image
image/gif

2600:9000:223f:fc00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 2600:9000:223f:fc00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 14 Sep 2023 17:45:23 GMT
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
via: 1.1 604f8ac78ed3ba5235c1a14794f2ac64.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 6348035
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: iyD_mkMtRwKc4z8v2Le21HGyQ2I2Zya9msxg5JOMIDPByEKc8t6sig==

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
server: nginx
x-server-name: app13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame A26A 3 KB
1 KB 121ms
46ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67753
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame A26A 20 KB
9 KB 116ms
41ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46117
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame A26A 202 KB
64 KB 138ms
51ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 27 Nov 2023 05:05:56 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A26A 42 B
63 B 73ms
73ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BreNuet4sV0yZVDaJhc4kSQrC56jE1TDtMRORYSTCqxgMKmpBqCEoMRSjayEiWW4qEEXKEGyWJLfJHezxVZwG_3i_nOM-UQ7aMAvNH39xTdKFZ9tM

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A26A 0
20 B 70ms
70ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=16272892342324679623&x=1&ct=76

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 59CC 131 KB
44 KB 892ms
891ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7578658000090989&output=html&h=280&slotname=1164531029&adk=2361666189&adf=3485704032&pi=t.ma~as.1164531029&w=956&fwrn=4&fwrnh=100&lmt=1696696072&rafmt=1&format=956x280&url=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701061556453&bpp=1&bdt=1520&idt=1&shv=r20231109&mjsv=m202311090101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1600x1200%2C728x90&nras=3&correlator=6430449762534&frm=20&pv=1&ga_vid=1535369883.1701061555&ga_sid=1701061555&ga_hid=608285011&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=322&ady=173&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079265%2C31078297%2C44807764%2C44808149%2C44808285%2C44809057&oid=2&pvsid=1389033803679421&tmod=336585411&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&dtd=4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

998099e420f8d8713a08cda84646ed342ae4fcfaed5d7eb1a29180f7fa19b31b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mazhuren.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 44583
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 05:05:57 GMT
expires: Mon, 27 Nov 2023 05:05:57 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK hm.js Show response
hm.baidu.com/ 29 KB
12 KB 1124ms
398ms Script
application/javascript 103.235.46.191
BAIDU Beijing Bai...

General

Check archive.org

Show headers Download Go to

Full URL

https://hm.baidu.com/hm.js?c4f1733c3f4f8121135118be1d428f70

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),

Reverse DNS

Software

apache /

Resource Hash

9028b2e840b52cac3c88ad547040153cbf5cc20dd62e8f311254b74c3e5a1c68

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 05:05:57 GMT
Content-Encoding: gzip
Strict-Transport-Security: max-age=172800
Server: apache
Etag: 67ea2129698f9a78a760b1049d32d77c
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: application/javascript
Cache-Control: max-age=0, must-revalidate
Content-Length: 11317

POST
H2 204 collect
region1.google-analytics.com/g/ 0
255 B 133ms
47ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-ME9H8EJXQD&gtm=45je3b81v9160440516&_p=1701061556459&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1535369883.1701061555&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1701061556&sct=1&seg=0&dl=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&dt=%E5%9C%A8%E7%BA%BF%E4%BA%8C%E7%BB%B4%E7%A0%81%E6%89%AB%E6%8F%8F&en=page_view&_fv=1&_ss=1&_ee=1&tfd=19499
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ME9H8EJXQD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mazhuren.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame D1C4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECGTpueHsosFsZEThnUG8zg&google_cver=1

43 B
339 B

54ms
53ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECGTpueHsosFsZEThnUG8zg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbFnv0BMAE&v=APEucNXNS95NIGBw3lPl6dPGSsUIE1UTo2oz8Itv8Nl3KzgMlcE11LGClCLIxMyX8KqtI-Tnsr3m1gWlxHJuBkLSAY6bR_FTZvkSF2AvIuTNoFqwuvlgJ4iWMnImW8ZDB7Q9T5ObU44ilbB2rQCsafBPhvI5Ysx1L_yD_tcmwXrTfk6g4-oBgxw
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M0JziwUTtTu5P1AMKlwwOWcqJbUiagYqiVhEEU5IQDYsD%2BVysdB3v7a%2Fz99sH9w8YcSN%2Flt7K2WwVU1nb1U5XTOOzOuaEE%2B2s%2Ff89IcOF17FZLUYeMJfLtbkNyxtNdlkTpxiiSciwLwyIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82c7d6c92fbc6a74-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECGTpueHsosFsZEThnUG8zg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D1C4
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWQjtNgpFFBbLDhZkwq7PwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECGTpueHsosFsZEThnUG8zg&google_cver=1

43 B
770 B

57ms
56ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECGTpueHsosFsZEThnUG8zg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbFnv0BMAE&v=APEucNXNS95NIGBw3lPl6dPGSsUIE1UTo2oz8Itv8Nl3KzgMlcE11LGClCLIxMyX8KqtI-Tnsr3m1gWlxHJuBkLSAY6bR_FTZvkSF2AvIuTNoFqwuvlgJ4iWMnImW8ZDB7Q9T5ObU44ilbB2rQCsafBPhvI5Ysx1L_yD_tcmwXrTfk6g4-oBgxw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6LdeNetvg7R4DESe7UTlxrmvmpLEtbv%2FtXo8uodGxGZKk%2BB8A1XoWYnuw5swZifpde8c7u0GOD%2BUYxfFjNhJR2mOsnTNjbmHNR2WQb0jtPiq6P9IBC%2Foc6cDHju3A6eZwxI7pQgWsryy2g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82c7d6c9ae4f2681-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECGTpueHsosFsZEThnUG8zg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame D1C4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGosxgoQMmHlu758lL_pg5E&google_cver=1

43 B
839 B

44ms
44ms

Image
image/gif

185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGosxgoQMmHlu758lL_pg5E&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJbFnv0BMAE&v=APEucNXNS95NIGBw3lPl6dPGSsUIE1UTo2oz8Itv8Nl3KzgMlcE11LGClCLIxMyX8KqtI-Tnsr3m1gWlxHJuBkLSAY6bR_FTZvkSF2AvIuTNoFqwuvlgJ4iWMnImW8ZDB7Q9T5ObU44ilbB2rQCsafBPhvI5Ysx1L_yD_tcmwXrTfk6g4-oBgxw

Protocol

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
an-x-request-uuid: 858d9a9b-a310-4b5e-b4f7-0722dcdb6ae3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.7.100; 80.255.7.100; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGosxgoQMmHlu758lL_pg5E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame D1C4
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUyODExMTEzNjYxNjk4Nzg5Mw%3D%3D

170 B
243 B

49ms
48ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUyODExMTEzNjYxNjk4Nzg5Mw%3D%3D

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
an-x-request-uuid: 990e84bf-ad15-485d-9c42-d5cbfebaf8ba
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUyODExMTEzNjYxNjk4Nzg5Mw%3D%3D
x-proxy-origin: 80.255.7.100; 80.255.7.100; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A26A 0
20 B 71ms
71ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5415551775315&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A26A 0
20 B 75ms
75ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5415551775315&version=m202309260101&ct=76&x=1&cor=16272892342324679000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A26A 92 KB
38 KB 81ms
81ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzfZ-AZJkEwP1_1zIcNzeoug1EVAccJXt0cB5iUzCv19_jp_8K9xDaGfutxa_qgvuz-CXSgbbtyNDATzg9jap1riH5avhw7uATVpd4DgUgkSQKWkMn8tua_Ke2W4suyvdNPayHMOGeGMhqrQRvad7V5ZjF5gtl0nLC6-b_9vL_TcMGkDQ&dbm_d=AKAmf-Du5jLkcj8JUYa2juwsTnXhQyQuxwgM0lVBbjvN4_lWWFI49G10Bql5dTTeXAqx2gA1mpNOS_HVWicNOE2ra2pmXB6bvSrcjrcqUhcLx81ndastLgNjrEPeQOfEhzD6U2iIeWovVXQYXan08do1ptHpkBdflk8yxpkyUaSzT6-gFeMfpfDKyvFsa94jQddgzIOspzyPrND0D35HwppJi4nNxRgP03-e40ZUOB81ldHYnpCWhfvcdvLCGTT7ErwCSTVROaD2SaoB_xy9mGYJRXHR35ALqs_NRTAfcvCSDnqM-1HZMndQ-xa-pCNw9_Cn7Z-__mOCDZ9KRTYqSEa1WL5zA3zblzcftxWvGatWAWPp4UPIwrhh3Jt6Ml_46A9WJdI5YLFKeBkl57hAR3pvcdDEtTNoKSk7ydJjepTrH8Vh_49pgFiZg3f3WmAIvQoXGq6ekyCHBrpU0GujglMcN4flfU_kYlEqFPu0Q-pAWb6cliTBfBlI9qUloTJVgAv9QQaRDQkIv1bFwF6O7kowR3auLvZqeYqzJrlLAHB7d34XBZ0aJ2GdKEkGYUE_xUFbNVfCtLZ5quf2b66Yv3IQRHccRseXl0EMkNtioJabh-IOtg5xCyS_yU0FUFP3LM2HezyxEOtMqSEkQd-fleKqIdc7MGPphS0kF_6h0lxau3fP2SWT_TyQZSeUZPCqYLlz2UagPAGCSV4hqP0ICSAqsy9fAqBlC21dN79JYqYq_evLUxQSWxHcwAXBzv7lV1_7PetX0-fnzguiF6cm6MPaWtlr1xTP-EzYWJStBO7RwQ7nWCfppoRXlMYZOk1Bo_WXe8ggxTK040EJ-gL9ofF9l9HfHPpmFGPfaa2Xg8vtxUPHekfW-lx7TGABivp2LlvobdyMl0D6zIFk3Fmrof9LTH0HpFIArbdqZJU1CtQSOZ8eyRF9oW_lH_L6NeARkpA9vbh2eKkFqQtX7iz5eu6Af7Apy8lEJKrp-YznLdUdgt4n9JsNpZCRSFLuPs6oh3k4hOy2Jxo-gd6nMlATqyvEQopwKEOQWbBRq3Xr2dXFxPOqZRc20pP9wjF1pvrA3JeuCFoHtvZiaiOBX8QQcGl3OBVEpi76hzsK-zYIiePBEvDliHLXzLhiNh-mZCDSnzRq55sQV28O-HKqZo0_suglQMpbF39axscTmdftnVpiFgXjW3SH_RN1TcZvaQ-TirMynLfTrf4tHIX1KavB1GX731GpwHzGf4EmYy9eBSDr_y6YsdfVxhcunGwas5fCAo2RbEQ191vTNTMExzsLzoWrZYO8ShL9yHefdu04JAdI6f01JWjifkwW25ErCAlZ2rs3u4L-oT3MDON3nUYrxKcLIj7DZ9l-g1Qpxz4ikrmvXy0RDxhQ1SyrbuNfMHIMt6pTLQejpMZ3uoXbI84TM-Cqi8uAOEyC4HmW8jdchgV7eRKEEX_NHBLX29HSL87goNBlo8JSaq0YwdeVQIy7Oob9v00lEI0Qni3BcseGPsH1qevlZFHTg2agZ6xiXvLPReFisI1Avh5W2aIVj1hLy53afHoeWxBUYwzAyy6hQe0NNfGf-YiaYR60yTG39eNZHUn6IIiLasEfMGOxzwCMF_2jqkdm6X3MTsGBbu6tZifPKJZgK_anCpwo40UCourAxJI1EkYmcZ_x4GVzBjcISabEjgPqVqxxXUz0kFjI9XLqm9UPKxGagDjytaoxAquYkCmoNv-yjcmgQ-C5ML9JcawkpWZh2mwtMeBHhCCwimtKdquZa5XojpAlJ6ch1ikwLJPx2elGHRmz3Rh4qLMKKkNw81wll4Bavg_jI0gJuBwOgKu7kNgVrlTRJ5gdzz1Bm4cSX4jZty-vS2su6_0Q5R0U-4Sp_HjH7VGOFUy8dJ-dTyuOP2NAvbXN83BxlINEz6iVPPQnygMlwE1qVtPDBmxkU1hZp3EHtZeJKmLS1Cj1BLNg9bFB7sgQXp2jC1CkADtHL1WeYZQbmurW2ZVukoRi5d0izwL_oXz4WQvg2tQji9ekNpCBpl6TDodLlZCWEpC63k_XbLMHhpHqRzzc2iH_0AGo0TMKwNgDw63M1Kn8pVu6qv5bX8iXGFxyJR-sl43gMNfF7VhQX42KJdBtaiZ6uZS3dtIi4DyhzYkuzEaE95bBdSKu9PdAtsRkYJA1srPdnfKidiDAO0oFOBWXuxpY2ECAjYjPScGlBwO4ZpmQsE9Dtm06NS33KUsJ4c8kzbcPJAR-rHdQx2Piofpc7t4DKcvzme4mOTTDNKpJ_Ai-gZBaUi_9MCu6kl_uMgZvJqqWJJ-bZPKb1DLJcqPDmNjgqohwsn90u0X_phaq-sXcYCAeVa9niXkDOabSC_6Yhv_dCeH_A5KghYcXzCw1l0Q74hkGiKvpili66iK6hKvkwmuAoTAWlKRzASUs-huV_v_ql9ZwFbpQA7-OBgQCF_4vxc9YERE5Bm9vRcmObLzE0yZwyqImMuQjMeKnIHHxSxd4EmYBIHFXi2xruobabMVB6S7cNEjCaBXN55ETdKpztfFIZBjPxuQj0-a9MV-wtmMREdneNi5bLUGvDSUL8FXxpXHmKKY798fB7oqDtVVec5EKv8KZfmoR5vcglnPxxQhPMDFOpec8KuGjZES8HVj3r6-9tHNl-nGp2jX-5dJodB1QRpmpRTTkUBy37wvGn5HL9XIbJ88kOQ1Pis9ClxqdeqCHR4VvLuQJiqchOUxJ_Ygyr4tOOORGlVe-dWg9dtv0XsuQs6dcX3WrwVQRiFhODQMYnXjvk6aL8fgRxjwWzZ4LVFMc7SWkxED4CijBcsnIFDEEtFAM60K8ekiAbYXlSA3TgkWTwBj6ww5VCwuuZp9mkBYzBwRL4RDlfqciaj9hansrFptaF7wTilWUg8XOGlIU6c08wxJvHQehpmt3zVWJKPbswxCjgV7qalJjS1G1ylFfFnhr4I1OuifjzSMK3C0wMILpKpixcS-cTRiOYwIYmPJrghVMu0WmvN9-H7iuwjeU_d5igIKx0B661Rdh9q31X1y2zOBjYEXfyNqvdgqGCETazOAQph7gOEKFVDFuB88Cs4DlABlCZWApUn4xWz-169Op2DqxL0ldO9lwbmIiA22QFij4Vd2V6Ox2_kTjDniOkz7Uf1ebn3YRSXBz3ZktyLAoZV6WT8tNALkjDSSNVf4WuC-o_QaA3GyLeJsyrn5Fog8IhjZ03Pg86MaCfk9Znv2wrY-t_2m425IAjZVd2Iv0MwSWhAKbSznjjqk6JBi0zUeYtOJIgDlbmDx0FY_ueYPIAnmYfyUig6JiXFs0wAvMMMZ5xWruKvs-Tlcq6XDQqbG8HffKJQsr0OzlqqMzKz57gg2VwqGc2e18oFSecb5HWQBqrYEQSzGGfU5mN99xJF_Y_0qm_dOm_leMSnefOWvlfB3hNWtuMyzOZC_AFGmDZY5ffIEWGN3vfgXw0Atq1OASOYJMDy_i2rLbqv3mEk19E-a4Q3L5IaoZjdaCZymx7WjpgcW4IT4VE0SsY07MJeRVVDecGKLd8aVIG84eyaf4L0NXnp1jZ9cHDJS_hj4pbnJKF-pf8yyRkS4O-8dh20Qm5eEW-MmwJkINcRiVlFbP76fawuymyT7upZh4MU_CZ78mtkCyr7eSZ_1NzsjLpc6N&cid=CAQSTwDICaaNOfwdEBJ1U9ysDrVqZ9FO-da4inGkhZJlvq-eHqEkZcUvlWH1V2vsp8MKhGk7G6S2pRx2DfsP6Mjezy8bdZg6-JRqK_odSS9xvXYYAQ&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.mazhuren.com%2F&ds=l&xdt=1&iif=1&cor=16272892342324679000&adk=497053795&idt=66&cac=0&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

272cc084414e91f53113d37362088c33c81fd24db9b777c34f473214e8a51959

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39218
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame EB43 14 KB
1 KB 49ms
49ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 27 Nov 2023 05:05:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 03:29:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Nov 2023 05:05:56 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame EB43 2 KB
875 B 39ms
39ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame EB43 23 KB
9 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B200 143 B
166 B 40ms
39ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2679
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 04:21:17 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame EB43 3 KB
1 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67753
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame EB43 20 KB
8 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46117
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame EB43 202 KB
64 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 27 Nov 2023 05:05:56 GMT

GET
H2 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame EB43 37 KB
15 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 500201
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Feb 2024 10:09:15 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame A26A 111 KB
39 KB 152ms
39ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 07:40:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77128
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Nov 2023 07:40:28 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame A26A 11 KB
4 KB 43ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzfZ-AZJkEwP1_1zIcNzeoug1EVAccJXt0cB5iUzCv19_jp_8K9xDaGfutxa_qgvuz-CXSgbbtyNDATzg9jap1riH5avhw7uATVpd4DgUgkSQKWkMn8tua_Ke2W4suyvdNPayHMOGeGMhqrQRvad7V5ZjF5gtl0nLC6-b_9vL_TcMGkDQ&dbm_d=AKAmf-Du5jLkcj8JUYa2juwsTnXhQyQuxwgM0lVBbjvN4_lWWFI49G10Bql5dTTeXAqx2gA1mpNOS_HVWicNOE2ra2pmXB6bvSrcjrcqUhcLx81ndastLgNjrEPeQOfEhzD6U2iIeWovVXQYXan08do1ptHpkBdflk8yxpkyUaSzT6-gFeMfpfDKyvFsa94jQddgzIOspzyPrND0D35HwppJi4nNxRgP03-e40ZUOB81ldHYnpCWhfvcdvLCGTT7ErwCSTVROaD2SaoB_xy9mGYJRXHR35ALqs_NRTAfcvCSDnqM-1HZMndQ-xa-pCNw9_Cn7Z-__mOCDZ9KRTYqSEa1WL5zA3zblzcftxWvGatWAWPp4UPIwrhh3Jt6Ml_46A9WJdI5YLFKeBkl57hAR3pvcdDEtTNoKSk7ydJjepTrH8Vh_49pgFiZg3f3WmAIvQoXGq6ekyCHBrpU0GujglMcN4flfU_kYlEqFPu0Q-pAWb6cliTBfBlI9qUloTJVgAv9QQaRDQkIv1bFwF6O7kowR3auLvZqeYqzJrlLAHB7d34XBZ0aJ2GdKEkGYUE_xUFbNVfCtLZ5quf2b66Yv3IQRHccRseXl0EMkNtioJabh-IOtg5xCyS_yU0FUFP3LM2HezyxEOtMqSEkQd-fleKqIdc7MGPphS0kF_6h0lxau3fP2SWT_TyQZSeUZPCqYLlz2UagPAGCSV4hqP0ICSAqsy9fAqBlC21dN79JYqYq_evLUxQSWxHcwAXBzv7lV1_7PetX0-fnzguiF6cm6MPaWtlr1xTP-EzYWJStBO7RwQ7nWCfppoRXlMYZOk1Bo_WXe8ggxTK040EJ-gL9ofF9l9HfHPpmFGPfaa2Xg8vtxUPHekfW-lx7TGABivp2LlvobdyMl0D6zIFk3Fmrof9LTH0HpFIArbdqZJU1CtQSOZ8eyRF9oW_lH_L6NeARkpA9vbh2eKkFqQtX7iz5eu6Af7Apy8lEJKrp-YznLdUdgt4n9JsNpZCRSFLuPs6oh3k4hOy2Jxo-gd6nMlATqyvEQopwKEOQWbBRq3Xr2dXFxPOqZRc20pP9wjF1pvrA3JeuCFoHtvZiaiOBX8QQcGl3OBVEpi76hzsK-zYIiePBEvDliHLXzLhiNh-mZCDSnzRq55sQV28O-HKqZo0_suglQMpbF39axscTmdftnVpiFgXjW3SH_RN1TcZvaQ-TirMynLfTrf4tHIX1KavB1GX731GpwHzGf4EmYy9eBSDr_y6YsdfVxhcunGwas5fCAo2RbEQ191vTNTMExzsLzoWrZYO8ShL9yHefdu04JAdI6f01JWjifkwW25ErCAlZ2rs3u4L-oT3MDON3nUYrxKcLIj7DZ9l-g1Qpxz4ikrmvXy0RDxhQ1SyrbuNfMHIMt6pTLQejpMZ3uoXbI84TM-Cqi8uAOEyC4HmW8jdchgV7eRKEEX_NHBLX29HSL87goNBlo8JSaq0YwdeVQIy7Oob9v00lEI0Qni3BcseGPsH1qevlZFHTg2agZ6xiXvLPReFisI1Avh5W2aIVj1hLy53afHoeWxBUYwzAyy6hQe0NNfGf-YiaYR60yTG39eNZHUn6IIiLasEfMGOxzwCMF_2jqkdm6X3MTsGBbu6tZifPKJZgK_anCpwo40UCourAxJI1EkYmcZ_x4GVzBjcISabEjgPqVqxxXUz0kFjI9XLqm9UPKxGagDjytaoxAquYkCmoNv-yjcmgQ-C5ML9JcawkpWZh2mwtMeBHhCCwimtKdquZa5XojpAlJ6ch1ikwLJPx2elGHRmz3Rh4qLMKKkNw81wll4Bavg_jI0gJuBwOgKu7kNgVrlTRJ5gdzz1Bm4cSX4jZty-vS2su6_0Q5R0U-4Sp_HjH7VGOFUy8dJ-dTyuOP2NAvbXN83BxlINEz6iVPPQnygMlwE1qVtPDBmxkU1hZp3EHtZeJKmLS1Cj1BLNg9bFB7sgQXp2jC1CkADtHL1WeYZQbmurW2ZVukoRi5d0izwL_oXz4WQvg2tQji9ekNpCBpl6TDodLlZCWEpC63k_XbLMHhpHqRzzc2iH_0AGo0TMKwNgDw63M1Kn8pVu6qv5bX8iXGFxyJR-sl43gMNfF7VhQX42KJdBtaiZ6uZS3dtIi4DyhzYkuzEaE95bBdSKu9PdAtsRkYJA1srPdnfKidiDAO0oFOBWXuxpY2ECAjYjPScGlBwO4ZpmQsE9Dtm06NS33KUsJ4c8kzbcPJAR-rHdQx2Piofpc7t4DKcvzme4mOTTDNKpJ_Ai-gZBaUi_9MCu6kl_uMgZvJqqWJJ-bZPKb1DLJcqPDmNjgqohwsn90u0X_phaq-sXcYCAeVa9niXkDOabSC_6Yhv_dCeH_A5KghYcXzCw1l0Q74hkGiKvpili66iK6hKvkwmuAoTAWlKRzASUs-huV_v_ql9ZwFbpQA7-OBgQCF_4vxc9YERE5Bm9vRcmObLzE0yZwyqImMuQjMeKnIHHxSxd4EmYBIHFXi2xruobabMVB6S7cNEjCaBXN55ETdKpztfFIZBjPxuQj0-a9MV-wtmMREdneNi5bLUGvDSUL8FXxpXHmKKY798fB7oqDtVVec5EKv8KZfmoR5vcglnPxxQhPMDFOpec8KuGjZES8HVj3r6-9tHNl-nGp2jX-5dJodB1QRpmpRTTkUBy37wvGn5HL9XIbJ88kOQ1Pis9ClxqdeqCHR4VvLuQJiqchOUxJ_Ygyr4tOOORGlVe-dWg9dtv0XsuQs6dcX3WrwVQRiFhODQMYnXjvk6aL8fgRxjwWzZ4LVFMc7SWkxED4CijBcsnIFDEEtFAM60K8ekiAbYXlSA3TgkWTwBj6ww5VCwuuZp9mkBYzBwRL4RDlfqciaj9hansrFptaF7wTilWUg8XOGlIU6c08wxJvHQehpmt3zVWJKPbswxCjgV7qalJjS1G1ylFfFnhr4I1OuifjzSMK3C0wMILpKpixcS-cTRiOYwIYmPJrghVMu0WmvN9-H7iuwjeU_d5igIKx0B661Rdh9q31X1y2zOBjYEXfyNqvdgqGCETazOAQph7gOEKFVDFuB88Cs4DlABlCZWApUn4xWz-169Op2DqxL0ldO9lwbmIiA22QFij4Vd2V6Ox2_kTjDniOkz7Uf1ebn3YRSXBz3ZktyLAoZV6WT8tNALkjDSSNVf4WuC-o_QaA3GyLeJsyrn5Fog8IhjZ03Pg86MaCfk9Znv2wrY-t_2m425IAjZVd2Iv0MwSWhAKbSznjjqk6JBi0zUeYtOJIgDlbmDx0FY_ueYPIAnmYfyUig6JiXFs0wAvMMMZ5xWruKvs-Tlcq6XDQqbG8HffKJQsr0OzlqqMzKz57gg2VwqGc2e18oFSecb5HWQBqrYEQSzGGfU5mN99xJF_Y_0qm_dOm_leMSnefOWvlfB3hNWtuMyzOZC_AFGmDZY5ffIEWGN3vfgXw0Atq1OASOYJMDy_i2rLbqv3mEk19E-a4Q3L5IaoZjdaCZymx7WjpgcW4IT4VE0SsY07MJeRVVDecGKLd8aVIG84eyaf4L0NXnp1jZ9cHDJS_hj4pbnJKF-pf8yyRkS4O-8dh20Qm5eEW-MmwJkINcRiVlFbP76fawuymyT7upZh4MU_CZ78mtkCyr7eSZ_1NzsjLpc6N&cid=CAQSTwDICaaNOfwdEBJ1U9ysDrVqZ9FO-da4inGkhZJlvq-eHqEkZcUvlWH1V2vsp8MKhGk7G6S2pRx2DfsP6Mjezy8bdZg6-JRqK_odSS9xvXYYAQ&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.mazhuren.com%2F&ds=l&xdt=1&iif=1&cor=16272892342324679000&adk=497053795&idt=66&cac=0&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46114
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 16:17:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame A26A 31 KB
12 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46114
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 16:17:22 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame A26A 41 KB
14 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 132514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
DATA 200
OK truncated
/ Frame A26A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 73f6a017831fe5f16b92ac3935faf6c4d85485ce7b4515329c70c0fb5d8a2b5f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B200
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

54ms
54ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 05:05:56 GMT
expires: Mon, 27 Nov 2023 05:05:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 05:05:56 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5804 38 KB
13 KB 39ms
39ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 132465
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 5804 39 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 22:10:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24954
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Nov 2024 22:10:02 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/8660697951102249597/ Frame 4D23 15 KB
5 KB 122ms
42ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ffa36b4310d6935fab68e6d90dd0acaeb07db7b7928a3f1416099529a4fbdad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 593397
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4933
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 08:15:59 GMT
expires: Tue, 19 Nov 2024 08:15:59 GMT
last-modified: Wed, 08 Nov 2023 13:36:29 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A26A 0
0 184ms
85ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssfpf4yJK1Cg_GS9WRAqn-RZu97hZZJx57Hn0ZYUYnZYTM66ddUNJwBNkep89uVzXepFj1xBA_CCauLlqzNqzAu_VXAFvkEkcv_uxSORZ7rW0Tb-TsnciwZOEr-e8BluOy0yjSDBUQ2fXiEJ5TJw5sEfPF0MbuOyE9xXQ3iEf6aOglr-ITCh7cdOJ289ohAQEBu2Ge-x36m1q85GktJxicYY3MEho1-oaYibOjV1mVBZAE1R1kxlCTnzhHrAaelgNCZqIM-RiHhz6fJMWdg8PrbNXaj7ZiLgKNGArRLV8PBVRkFeIdfYwRD1-saJ3FmVl9VTYskC0p44cCapVpB63i6vQ74WB82gMPZTGxbuYUb7hWCyAgQixn2IXVBlrYpC3MEoKdfqTgOaQeMdbNTq7PPvoijHTs3KVDrWEehoRc1Ri9H9CFJy-QCIOToo3FJkSzUFgi_-WVP7-xBZ-7qONvXiy156Snb84KfUETeXbpR9A739xHJWm5Ib0ct8GvccdBHnqCGzW1zRIWfp0_X598wnIRzCGGY91gWQj2MHFnoYGSJgGqNR0z0th0a7OP397q8xUd7vo54myL7T-nYWT0U6OtAtF4wS63wdx4vYqa1buJBDrin1SyPvjDwNq9_8FO9Z3rjpk0OR67P97acClYzD4d3bFGW6bb2-ubs6XlsSvc6JaHrB08Qw8Zovz5n_vqkWgwjC1Eh4TMVX63nVqKlSmKluamjv9tE5EcWojCNx9dPrYoKmSd31d-0RzhAn0xfpOvrfP_kf3H4xFxnWgLUzwcoVt6Te-XDZQysGS5x4ciF3joWI1l9-E_gsMNGzEBv1yyY9PB7CsBUos_OQT9c5yaAhbmxVGW_oYg6cM-Y0G67c2NzDsLxCSs0nsMbFLmxhttTJBtftOEKn-LTrKEugPlsoDaMn0X1FQjwXOjIWXhQY6AHFYfXm0MmXsjWyiibtbgQThW2461eW4HQsdX3e8DIUgiqaN8N4VLNM5bEffe3xAFfub0ETqs9c5azmut1nFqTn5nQI_HmFo_lz4_tVPI2IayJUaO7MjMNiypsZSsrHHCtqKcvOuzKBbtmCeCxHXQa12zU3T04RCOL3YH0Pr69OY7C7-LKRXCdovcLH6eN-cpHOPrAJ6K4EVkBSki-86fucC3KvaX_wOrmtmTI0xxaPoQnNbbNKSyuZE_dzsh2wJfWaYXTrB899P2JQJAUa8GjC3y9SF_XyMsxhk-GL5fJZDts8XG_XrEB6WXa7MEEgkNa7S0D6bA4XXahwdodnRTxdsHPrmBdmvQn_4oUdBwsVDMNhWkiXjwFKrNl-qYuXMKr2cDkKdJhpf5Y&sai=AMfl-YQF-Sf_JEZPdve3PBwGe8fXTsX-v7J2D2BwSi78v3lnFlSXczo2c-i21rY1fwcP6dyapcyxFAyOSJGROYSPmyieH-OaTzHqEu8EqDQvJjTCc4vv5g4OBko_SMDmH1Pol3ebqenfbjo4qDXOl3q27ZYXiHCmLHkuf2rNFe5ct5CCoWBZfAWEEmxL4oXE4hBczUz4ox6Q2siPRuNEgO1pfTynui50jbfAZnHhCETLF5a-P0CrtwaDI_PVXbuLLu7kvyLCg0wjwIXNVxFs-RVzt3DnRV8Bl1uReiTcuyx1dQ&sig=Cg0ArKJSzM01JVVRGSaEEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=213&cbvp=1&cstd=212&cisv=r20231109.95724&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 27 Nov 2023 05:05:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

firstevent
skydeutschland.demdex.net/ Frame A26A
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=205036047&d_placement=380833143&d_campaign=30999372&d_bust=3793360539&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=205036047&d_placement=380833143&d_campaign=30999372&d_bust=3793360539&gdpr=&gdp...

42 B
735 B

58ms
57ms

Image
image/gif

54.73.183.248
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=205036047&d_placement=380833143&d_campaign=30999372&d_bust=3793360539&gdpr=&gdpr_consent=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Server

54.73.183.248 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-73-183-248.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v054-076076086.edge-irl1.demdex.com 4 ms
pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: OXN87sDBS+U=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v054-00cd77fef.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: 6qJp0Ho3RNU=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=205036047&d_placement=380833143&d_campaign=30999372&d_bust=3793360539&gdpr=&gdpr_consent=
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame A26A 43 B
1 KB 193ms
50ms Image
image/gif 85.14.248.71
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=1014760199&extPm=531079830&extCr=20761493732&gdpr=&gdpr_consent=&rnd=3793360539

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

85.14.248.71 Neukirchen-Vluyn, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Mon, 27 Nov 2023 05:05:56 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mo, 27 Nov 2023 05:05:56 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 6h7OZzYWuChAMW0yNvwaAqN_brH89lOBLHEXo8EbMVo.js Show response
pagead2.googlesyndication.com/bg/ Frame BDA6 39 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6h7OZzYWuChAMW0yNvwaAqN_brH89lOBLHEXo8EbMVo.js

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea1ece673616b82840316d3236fc1a02a37f6eb1fcf653812c7117a3c11b315a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 00:36:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275387
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15097
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 00:36:09 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5804 0
20 B 76ms
76ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BrmoktCNkZbn1Ifnm1PIP1ISC4AwAAAAAOAHgBAI&bg=!jI-lj8DNAAZxrfrxUa07ADQBe5WfOPFFKqeHRFZuKbrrD6F9EtrJVmklM8i6R0lnPdPlhzl-y9PzlrmoGWrcY776Cz0fAgAAADFSAAAAAWgBBwoAHieCGmehWZmqFlcNGBV1e_57tVcL0Pt5dNlVUX9QmpkC_rxi7xKw5ztZQNBnYq6A-z34h4C5C-pnJdJwTg4Kr8tV0vlMoxteAgUi2tthn84hEvpilq6NRBJq3Jy7rnCiVt1SSzAZQmWDsyU_IhWzmB_dmSRnc4jHItVNrb059_Swqd0xU652SE2tXthamSTWbMbO6flwqnktKF_zOSRubs0BZ8OqtV1BKGT3Csfl6zd6xakoQYC1r15aH81ri4H9-TORVNJzIe9yxEwcs4zTt_g0dLxUGHWs3DVyWlAcEP7gI4xa57kiAq2IKhfceZIpEa4EV1x_xuCDdA__1JYxuDj_BAcBfDSitKEwuxxxQT4WhCzjyX4OxMBgxM8zgD6FxJkHw1fz3EVQlZav-66u2FTAVlrfVWVoUK8mHKI2pBSe9UyDUA3b0XxrPbkstL2Asa2uUwhO3ajIrEi1EGkMNDMu0KddYz0xS0Te8JRXNsxt6qaEpYdB5pNnErXuCO5JT86l6xYWI0J-DJDy1cqyas5HZg9TE1ZCb9OvWMPzkBaGYwgi9t5-uasUr9LiG5E3cosCxVEh4f2Fgug_bM9MHPEbICGFh2Cp_5fJU45ifbT46EmPuNXGtP6zdhRKgh7UnP86PMa8Wgz_ALMyBqXUWF-umMg1aFsT3ul8N6Ggh4REMknGnU94n2768aNvfxE0Em5d2Lk24ck4RbBYWWmzgY7_jvsrW441ole0JNL-lXm-zl54D08lIFeb3yo2j1oDhEN9P2Jvf190MKbeVNWVt8_u2pWG1fA6igYuJqPXiHQdktQKukhQXd0W0p9ZYuB7uffmSU3yp5_ANLsKb2HIA2FJJrEzYHZz8FmiEBvxCjXkynzPCE78qiZaFUaNebB1H-yXDBtvGxVzucrqGVPR0G45QKI5n4BgJkKz51Tni_SzYAmb1JUdt01BKCcexWKeqYZcc2AcKuuU-5OZJJXPyhq5SCG6dllnju0NNqBCI1r9oy3g4w_zscfwElZJLK_H81kDEj0i2Z7oSs6aH-mccMOGBmTCq1T7mrziICmMdAk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 4D23 236 KB
63 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Nov 2023 05:05:56 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A26A 0
0 81ms
77ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssfpf4yJK1Cg_GS9WRAqn-RZu97hZZJx57Hn0ZYUYnZYTM66ddUNJwBNkep89uVzXepFj1xBA_CCauLlqzNqzAu_VXAFvkEkcv_uxSORZ7rW0Tb-TsnciwZOEr-e8BluOy0yjSDBUQ2fXiEJ5TJw5sEfPF0MbuOyE9xXQ3iEf6aOglr-ITCh7cdOJ289ohAQEBu2Ge-x36m1q85GktJxicYY3MEho1-oaYibOjV1mVBZAE1R1kxlCTnzhHrAaelgNCZqIM-RiHhz6fJMWdg8PrbNXaj7ZiLgKNGArRLV8PBVRkFeIdfYwRD1-saJ3FmVl9VTYskC0p44cCapVpB63i6vQ74WB82gMPZTGxbuYUb7hWCyAgQixn2IXVBlrYpC3MEoKdfqTgOaQeMdbNTq7PPvoijHTs3KVDrWEehoRc1Ri9H9CFJy-QCIOToo3FJkSzUFgi_-WVP7-xBZ-7qONvXiy156Snb84KfUETeXbpR9A739xHJWm5Ib0ct8GvccdBHnqCGzW1zRIWfp0_X598wnIRzCGGY91gWQj2MHFnoYGSJgGqNR0z0th0a7OP397q8xUd7vo54myL7T-nYWT0U6OtAtF4wS63wdx4vYqa1buJBDrin1SyPvjDwNq9_8FO9Z3rjpk0OR67P97acClYzD4d3bFGW6bb2-ubs6XlsSvc6JaHrB08Qw8Zovz5n_vqkWgwjC1Eh4TMVX63nVqKlSmKluamjv9tE5EcWojCNx9dPrYoKmSd31d-0RzhAn0xfpOvrfP_kf3H4xFxnWgLUzwcoVt6Te-XDZQysGS5x4ciF3joWI1l9-E_gsMNGzEBv1yyY9PB7CsBUos_OQT9c5yaAhbmxVGW_oYg6cM-Y0G67c2NzDsLxCSs0nsMbFLmxhttTJBtftOEKn-LTrKEugPlsoDaMn0X1FQjwXOjIWXhQY6AHFYfXm0MmXsjWyiibtbgQThW2461eW4HQsdX3e8DIUgiqaN8N4VLNM5bEffe3xAFfub0ETqs9c5azmut1nFqTn5nQI_HmFo_lz4_tVPI2IayJUaO7MjMNiypsZSsrHHCtqKcvOuzKBbtmCeCxHXQa12zU3T04RCOL3YH0Pr69OY7C7-LKRXCdovcLH6eN-cpHOPrAJ6K4EVkBSki-86fucC3KvaX_wOrmtmTI0xxaPoQnNbbNKSyuZE_dzsh2wJfWaYXTrB899P2JQJAUa8GjC3y9SF_XyMsxhk-GL5fJZDts8XG_XrEB6WXa7MEEgkNa7S0D6bA4XXahwdodnRTxdsHPrmBdmvQn_4oUdBwsVDMNhWkiXjwFKrNl-qYuXMKr2cDkKdJhpf5Y&sai=AMfl-YQF-Sf_JEZPdve3PBwGe8fXTsX-v7J2D2BwSi78v3lnFlSXczo2c-i21rY1fwcP6dyapcyxFAyOSJGROYSPmyieH-OaTzHqEu8EqDQvJjTCc4vv5g4OBko_SMDmH1Pol3ebqenfbjo4qDXOl3q27ZYXiHCmLHkuf2rNFe5ct5CCoWBZfAWEEmxL4oXE4hBczUz4ox6Q2siPRuNEgO1pfTynui50jbfAZnHhCETLF5a-P0CrtwaDI_PVXbuLLu7kvyLCg0wjwIXNVxFs-RVzt3DnRV8Bl1uReiTcuyx1dQ&sig=Cg0ArKJSzM01JVVRGSaEEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=440&vt=11&dtpt=227&dett=3&cstd=212&cisv=r20231109.95724&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 38bcf84a6c98f8ab5c7e5b9a6f0eaec8.js Show response
www.gstatic.com/mysidia/ Frame 59CC 9 KB
4 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/38bcf84a6c98f8ab5c7e5b9a6f0eaec8.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7578658000090989&output=html&h=280&slotname=1164531029&adk=2361666189&adf=3485704032&pi=t.ma~as.1164531029&w=956&fwrn=4&fwrnh=100&lmt=1696696072&rafmt=1&format=956x280&url=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701061556453&bpp=1&bdt=1520&idt=1&shv=r20231109&mjsv=m202311090101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1600x1200%2C728x90&nras=3&correlator=6430449762534&frm=20&pv=1&ga_vid=1535369883.1701061555&ga_sid=1701061555&ga_hid=608285011&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=322&ady=173&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079265%2C31078297%2C44807764%2C44808149%2C44808285%2C44809057&oid=2&pvsid=1389033803679421&tmod=336585411&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

70602b2d4f8fd19b95f522d3f3334ada3b3ff4647b4e81c7285b885977fd9ac4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 14:04:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226888
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4046
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 22 Feb 2024 14:04:29 GMT

GET
H3 200 78b00c21e40332afd18050ebd59c6b08.js Show response
www.gstatic.com/mysidia/ Frame 59CC 11 KB
5 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/78b00c21e40332afd18050ebd59c6b08.js?tag=text/vanilla_highlight

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b82aa6c527e41e336e9cd392fffa550353f896f71a3c632a5bdd51e22de4ca0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 00:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 276729
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4753
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 22 Feb 2024 00:13:48 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 59CC 14 KB
1 KB 49ms
49ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 27 Nov 2023 05:05:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 04:25:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Nov 2023 05:05:57 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 59CC 2 KB
822 B 39ms
39ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 59CC 23 KB
9 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:09:15 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 59CC 3 KB
1 KB 48ms
47ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:16:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67754
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 10:16:43 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 59CC 20 KB
8 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46118
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Dec 2023 16:17:19 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 59CC 0
0 48ms
46ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRGZvvG8lAdhWBAwfyTUQ4k9tO4IeSs7EseqhSM2r4cs4Jd1yl9bZ5F_fUqRInMcZnRxOpqq4ld6YCko2clcDOeCiT-4Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7578658000090989&output=html&h=280&slotname=1164531029&adk=2361666189&adf=3485704032&pi=t.ma~as.1164531029&w=956&fwrn=4&fwrnh=100&lmt=1696696072&rafmt=1&format=956x280&url=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701061556453&bpp=1&bdt=1520&idt=1&shv=r20231109&mjsv=m202311090101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1600x1200%2C728x90&nras=3&correlator=6430449762534&frm=20&pv=1&ga_vid=1535369883.1701061555&ga_sid=1701061555&ga_hid=608285011&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=322&ady=173&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079265%2C31078297%2C44807764%2C44808149%2C44808285%2C44809057&oid=2&pvsid=1389033803679421&tmod=336585411&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&dtd=4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 59CC 202 KB
64 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 27 Nov 2023 05:05:57 GMT

GET
H3 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame 59CC 37 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 500202
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 19 Feb 2024 10:09:15 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F33F 143 B
166 B 41ms
39ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7578658000090989&output=html&h=280&slotname=1164531029&adk=2361666189&adf=3485704032&pi=t.ma~as.1164531029&w=956&fwrn=4&fwrnh=100&lmt=1696696072&rafmt=1&format=956x280&url=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701061556453&bpp=1&bdt=1520&idt=1&shv=r20231109&mjsv=m202311090101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1600x1200%2C728x90&nras=3&correlator=6430449762534&frm=20&pv=1&ga_vid=1535369883.1701061555&ga_sid=1701061555&ga_hid=608285011&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=322&ady=173&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079265%2C31078297%2C44807764%2C44808149%2C44808285%2C44809057&oid=2&pvsid=1389033803679421&tmod=336585411&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2680
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 04:21:17 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F7A9 1 KB
643 B 42ms
40ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 46067
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 16:18:10 GMT
etag: 48472445140208031
expires: Mon, 27 Nov 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 59CC 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6fe345936fda3457c97b176a6f547fa2d928c23067012747835c5c936793fb6e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F7A9
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBOQjl9ZmbNswCypsUzqQfY&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEBOQjl9ZmbNswCypsUzqQfY&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=UFdjTnJsaDIxUjd0T0o1&google_gid=CAESEBOQjl9ZmbNswCypsUzqQfY&google_cver=1&google_push=AXcoOmS298nbmYucO_pcNmy0-IhoarWQaFOWQ-4AJ_bwK2A...

170 B
188 B

49ms
49ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=UFdjTnJsaDIxUjd0T0o1&google_gid=CAESEBOQjl9ZmbNswCypsUzqQfY&google_cver=1&google_push=AXcoOmS298nbmYucO_pcNmy0-IhoarWQaFOWQ-4AJ_bwK2AtMzsfqGwm0rLWb-1NiCyNpe-qJJWPzDWk46xtejADuhnBNaUEewF6zsc

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Nov 2023 05:05:57 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-091a6d662d9a132c7@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=UFdjTnJsaDIxUjd0T0o1&google_gid=CAESEBOQjl9ZmbNswCypsUzqQfY&google_cver=1&google_push=AXcoOmS298nbmYucO_pcNmy0-IhoarWQaFOWQ-4AJ_bwK2AtMzsfqGwm0rLWb-1NiCyNpe-qJJWPzDWk46xtejADuhnBNaUEewF6zsc
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F7A9
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEHy5CgmE0lDoMlZfy2uQ_bE&google_cver=1&google_push=AXcoOmTi6epZ3RCaRLfuzJL-2p5-OXd-7Oe96CzBTnfk_qaw2Bc-TMtrKu8MV-JjyHcliaEoA4HAvQx4ia_xXXhBkf01wixX-9fiaCk
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=0D2066A7C92F42E3AE7D59D4B7D0C614&google_push=AXcoOmTi6epZ3RCaRLfuzJL-2p5-OXd-7Oe96CzBTnfk_qaw2Bc-TMtrKu8MV-JjyHcliaEoA4HAvQx4ia_xXXh...

170 B
188 B

50ms
49ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=0D2066A7C92F42E3AE7D59D4B7D0C614&google_push=AXcoOmTi6epZ3RCaRLfuzJL-2p5-OXd-7Oe96CzBTnfk_qaw2Bc-TMtrKu8MV-JjyHcliaEoA4HAvQx4ia_xXXhBkf01wixX-9fiaCk

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Nov 2023 05:05:57 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=0D2066A7C92F42E3AE7D59D4B7D0C614&google_push=AXcoOmTi6epZ3RCaRLfuzJL-2p5-OXd-7Oe96CzBTnfk_qaw2Bc-TMtrKu8MV-JjyHcliaEoA4HAvQx4ia_xXXhBkf01wixX-9fiaCk
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sun, 26 Nov 2023 05:05:57 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame F7A9 70 B
149 B 175ms
56ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEOysVT-y8WvaZvn8450aIr8&google_cver=1&google_push=AXcoOmRfG621wkf5uCP_bIHBH9D_1kDHBtbfUYYaMj6epJYh25WAWpvL6ictttr7LOkUqd0qbWW_jYWxmwJU34NvgIqp8OAlCW7-Dok
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7578658000090989&output=html&h=280&slotname=1164531029&adk=2361666189&adf=3485704032&pi=t.ma~as.1164531029&w=956&fwrn=4&fwrnh=100&lmt=1696696072&rafmt=1&format=956x280&url=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701061556453&bpp=1&bdt=1520&idt=1&shv=r20231109&mjsv=m202311090101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1600x1200%2C728x90&nras=3&correlator=6430449762534&frm=20&pv=1&ga_vid=1535369883.1701061555&ga_sid=1701061555&ga_hid=608285011&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=322&ady=173&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C31079265%2C31078297%2C44807764%2C44808149%2C44808285%2C44809057&oid=2&pvsid=1389033803679421&tmod=336585411&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&dtd=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:57 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F7A9
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEOG-jsyRjgfwgzAqUXWkU5w&google_cver=1&google_push=AXcoOmQNPkKlqM76u9OG8XOjOd3dsbL4HZfEWqNyZcy_iDcZBDgq3xjfxqIE1UPwObQAyLFDLmmKftfWLlW2QZ...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjAwMzc1NTgwNjA5NTUxMg%3D%3D&google_push=AXcoOmQNPkKlqM76u9OG8XOjOd3dsbL4HZfEWqNyZcy_iDcZBDgq3xjfxqIE1UPwObQAyLFDLmmKftfWLlW2QZh9gX...

170 B
188 B

50ms
49ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjAwMzc1NTgwNjA5NTUxMg%3D%3D&google_push=AXcoOmQNPkKlqM76u9OG8XOjOd3dsbL4HZfEWqNyZcy_iDcZBDgq3xjfxqIE1UPwObQAyLFDLmmKftfWLlW2QZh9gXarXWxTYzdLVlc

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjAwMzc1NTgwNjA5NTUxMg%3D%3D&google_push=AXcoOmQNPkKlqM76u9OG8XOjOd3dsbL4HZfEWqNyZcy_iDcZBDgq3xjfxqIE1UPwObQAyLFDLmmKftfWLlW2QZh9gXarXWxTYzdLVlc
Date: Mon, 27 Nov 2023 05:05:57 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F7A9
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEJtCOgR0wcHSae6cZat4UDk&google_cver=1&google_push=AXcoOmRgvJeAdwT4W3oMZXuxpghbqF6og6mL48_jF1Bu5e-XwBlrsEzlg9XMfVuRYHHtK_BvNlxVskpce-nI57QC...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=W9XrwCQBQ48rwKnk8dT27Q&google_push=AXcoOmRgvJeAdwT4W3oMZXuxpghbqF6og6mL48_jF1Bu5e-XwBlrsEzlg9XMfVuRYHHtK_BvNlxVskpce-nI57QCZxGY84BIYZ7alzs

170 B
188 B

50ms
50ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=W9XrwCQBQ48rwKnk8dT27Q&google_push=AXcoOmRgvJeAdwT4W3oMZXuxpghbqF6og6mL48_jF1Bu5e-XwBlrsEzlg9XMfVuRYHHtK_BvNlxVskpce-nI57QCZxGY84BIYZ7alzs

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Nov 2023 05:05:57 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=W9XrwCQBQ48rwKnk8dT27Q&google_push=AXcoOmRgvJeAdwT4W3oMZXuxpghbqF6og6mL48_jF1Bu5e-XwBlrsEzlg9XMfVuRYHHtK_BvNlxVskpce-nI57QCZxGY84BIYZ7alzs
x-host: tde-deliveryengine-production-bb588bf9-rwjq5
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F7A9
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEK5nSoad4NuNo9vei8mdY-Q&google_cver=1&google_push=AXcoOmQG5RFx0Nic3ex43y27iFWAeZprEnn5bH5IBHtPTa8NpDzzhj_ipJyuDTcmsslieFxPSJYzqtyW...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEK5nSoad4NuNo9vei8mdY-Q&google_cver=1&google_push=AXcoOmQG5RFx0Nic3ex43y27iFWAeZprEnn5bH5IBHtPTa8NpDzzhj_ipJyuDTcmsslieFxPSJY...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODk1MzgxNTg4OTAzMDA4OTA1NQ&google_push=AXcoOmQG5RFx0Nic3ex43y27iFWAeZprEnn5bH5IBHtPTa8NpDzzhj_ipJyuDTcmsslieFxPSJYzqt...

170 B
188 B

49ms
49ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODk1MzgxNTg4OTAzMDA4OTA1NQ&google_push=AXcoOmQG5RFx0Nic3ex43y27iFWAeZprEnn5bH5IBHtPTa8NpDzzhj_ipJyuDTcmsslieFxPSJYzqtyWul1LM8AD7qQmgfceQDFK0Oc

Requested by

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODk1MzgxNTg4OTAzMDA4OTA1NQ&google_push=AXcoOmQG5RFx0Nic3ex43y27iFWAeZprEnn5bH5IBHtPTa8NpDzzhj_ipJyuDTcmsslieFxPSJYzqtyWul1LM8AD7qQmgfceQDFK0Oc
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F7A9
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEE8eDTD4MdNHwDmJFk0yDds&google_cver=1&google_push=AXcoOmSxHxoEsrl-4LnLrE7ogd58fjnKKfQO1c1Ir3Pad0Un6tE9kVx7fN6hcvygl3OE9pzTZrjWmpNBvEet_McDwGkfLno...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEE8eDTD4MdNHwDmJFk0yDds&google_cver=1&google_push=AXcoOmSxHxoEsrl-4LnLrE7ogd58fjnKKfQO1c1Ir3Pad0Un6tE9kVx7fN6hcvygl3OE9pzTZrjWmpNBvEet_McDwGkfL...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSxHxoEsrl-4LnLrE7ogd58fjnKKfQO1c1Ir3Pad0Un6tE9kVx7fN6hcvygl3OE9pzTZrjWmpNBvEet_McDwGkfLnoXGFlv4Cw

170 B
188 B

48ms
48ms

Image
image/png

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSxHxoEsrl-4LnLrE7ogd58fjnKKfQO1c1Ir3Pad0Un6tE9kVx7fN6hcvygl3OE9pzTZrjWmpNBvEet_McDwGkfLnoXGFlv4Cw

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSxHxoEsrl-4LnLrE7ogd58fjnKKfQO1c1Ir3Pad0Un6tE9kVx7fN6hcvygl3OE9pzTZrjWmpNBvEet_McDwGkfLnoXGFlv4Cw
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F7A9 0
12 B 47ms
46ms Image
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LOP-6WjwKVni6FJqxuqHnysth945VSaUB7viAjuEF5znXpzuwNtpnxgVbi9w_GEGrnGbiW

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:57 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F33F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

47ms
47ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 05:05:57 GMT
expires: Mon, 27 Nov 2023 05:05:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 05:05:57 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 47ms
47ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-ME9H8EJXQD&gtm=45je3b81v9160440516&_p=1701061556459&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1535369883.1701061555&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&_s=2&sid=1701061556&sct=1&seg=0&dl=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&dt=%E5%9C%A8%E7%BA%BF%E4%BA%8C%E7%BB%B4%E7%A0%81%E6%89%AB%E6%8F%8F&en=scroll&epn.percent_scrolled=90&_et=5&tfd=20519
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ME9H8EJXQD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mazhuren.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 59CC 33 KB
34 KB 126ms
39ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 09:09:18 GMT
x-content-type-options: nosniff
age: 503799
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 09:09:18 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75aebd1ba152f0544c46a628e3e3977c95c0f1a38dab803a3de70294d15f982b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 59CC
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CtI4vtCNkZaqrHoTa1fAPuIKM-A_Y_92OdM_Q4e7REqqXwPzrAhABIPq6zQVglZKggrAHoAHI-6n0AsgBAakCB8Q0K5Nasj6oAwHIA8MEqgTrAU_Q-yzC1AWIemHSIZtDC9oNJCCK2e3fp0w...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229318104440848011767%22,%22debug_reporting%22:true,%22destination%22:%22https://moghaddam-groos.de%22,%22event_report_windo...

0
0

157ms
76ms

Fetch
text/css

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229318104440848011767%22,%22debug_reporting%22:true,%22destination%22:%22https://moghaddam-groos.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22780828104%22],%224%22:[%2211-27%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221535355331831839409%22}&andc=true

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Server

142.250.74.194 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:58 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"9318104440848011767","debug_reporting":true,"destination":"https://moghaddam-groos.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["780828104"],"4":["11-27"],"6":["true"]},"priority":"500","source_event_id":"1535355331831839409"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 27 Nov 2023 05:05:58 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 27 Nov 2023 05:05:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"9318104440848011767","debug_reporting":true,"destination":"https://moghaddam-groos.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["780828104"],"4":["11-27"],"6":["true"]},"priority":"500","source_event_id":"1535355331831839409"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 6h7OZzYWuChAMW0yNvwaAqN_brH89lOBLHEXo8EbMVo.js Show response
pagead2.googlesyndication.com/bg/ Frame C878 39 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6h7OZzYWuChAMW0yNvwaAqN_brH89lOBLHEXo8EbMVo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea1ece673616b82840316d3236fc1a02a37f6eb1fcf653812c7117a3c11b315a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 00:36:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275388
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15097
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 00:36:09 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 171ms
71ms Preflight
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 27 Nov 2023 05:05:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A26A 42 B
174 B 74ms
73ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstvk98E7KJw07G6odiqI_CkcjgMxYTc-OnUkeKPo0s1drDh4ks374tU_rj8scEChg4rMafhSfoZLcHbVFZfU3laucn274wTogICtcVf7f6FkcNqJkOma5DWfC7T7oI3jSUxIigqZ60r5-gw&sai=AMfl-YS0J8Dt134Wj9dTjcLk3Bxp0e_y15nzVVdPmJJXYF5VO6MbhMMJxeLN94oNmHTtc-Fb-w-TveHnTBILePL-zuLSuZ4JrkijdippJYXA4R9CzJqPpuwsJGUVKw9jYw3Xg0Ljn-SGvqH-8T26TNXKVQ&sig=Cg0ArKJSzJsUaRNuShn1EAE&cid=CAQSTwDICaaNOfwdEBJ1U9ysDrVqZ9FO-da4inGkhZJlvq-eHqEkZcUvlWH1V2vsp8MKhGk7G6S2pRx2DfsP6Mjezy8bdZg6-JRqK_odSS9xvXYYAQ&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=351,845,1000,1000,1000&tos=351,494,155,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701061556443&rpt=361&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.js Show response
s0.2mdn.net/sadbundle/8660697951102249597/ Frame 4D23 135 KB
22 KB 40ms
40ms Script
application/x-javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8660697951102249597/index.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc608f4a24b2d6423c4743821986af7d7f3fef1e2b3bf8dc4cf0864eb3c1d5d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 08:16:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593397
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22997
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 13:36:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 19 Nov 2024 08:16:01 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/8660697951102249597/ Frame 4D23 8 KB
2 KB 39ms
39ms Script
application/x-javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/8660697951102249597/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b774a4be3b45ab7c1cbba8d6a4b19bcbcb4e9ebae699b125b05e6f17b6bd57d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 08:16:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593397
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1993
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 13:36:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 19 Nov 2024 08:16:01 GMT

GET
H3 200 index_atlas_P_1.png
s0.2mdn.net/sadbundle/8660697951102249597/images/ Frame 4D23 137 KB
137 KB 40ms
40ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8660697951102249597/images/index_atlas_P_1.png

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

442403f662802cc840ca7cec818685d4b1588509978e8eb2fc98cc195c72acd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 08:16:01 GMT
x-content-type-options: nosniff
age: 593397
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139942
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 13:36:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 19 Nov 2024 08:16:01 GMT

GET
H/1.1 200
OK hm.gif
hm.baidu.com/ 43 B
299 B 408ms
408ms Image
image/gif 103.235.46.191
BAIDU Beijing Bai...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-us&lo=0&rnd=174152630&si=c4f1733c3f4f8121135118be1d428f70&v=1.3.0&lv=1&sn=35098&r=0&ww=1600&u=https%3A%2F%2Fwww.mazhuren.com%2Fsaoma%2F&tt=%E5%9C%A8%E7%BA%BF%E4%BA%8C%E7%BB%B4%E7%A0%81%E6%89%AB%E6%8F%8F

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),

Reverse DNS

Software

apache /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=172800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Nov 2023 05:05:58 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
Server: apache
Content-Type: image/gif
Cache-Control: private, max-age=0, no-cache
Content-Length: 43

GET
H3 200 index_atlas_NP_1.jpg
s0.2mdn.net/sadbundle/8660697951102249597/images/ Frame 4D23 2 KB
2 KB 40ms
40ms Image
image/jpeg 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/8660697951102249597/images/index_atlas_NP_1.jpg

Requested by

Host: www.mazhuren.com
URL: https://www.mazhuren.com/saoma/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e229474f67daf83c68c465db8dc8451b46eda59b26ec1e36ffd0f746225c6fd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/8660697951102249597/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 08:16:02 GMT
x-content-type-options: nosniff
age: 593396
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2116
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 13:36:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 19 Nov 2024 08:16:02 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A26A 0
20 B 71ms
71ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5415551775315&version=m202309260101&ct=76&x=1&cor=16272892342324679000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 56ms
55ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231109&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bfe3d32ef6f1b54eb76cc6e2afce4e650b8837b29640d99e75e91a2e457e109e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12376
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 50ms
50ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 27 Nov 2023 05:05:58 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 59CC 42 B
64 B 85ms
85ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvZ-XCNeIwox6uJmrSPuTa7qnEvW0ckuKCJqnLecq7pcYmCI4MV1ztrnt4I3xfVyh0aGvOaxV_dWwFeJs68uv5B3XeQdl2lFtI2jGRWm6Qzy-C1g9617Dg_I1fLemRMYsUuWsUyRk5B9DKM&sai=AMfl-YT-A0Yo9CNMUMwB_c-YwnSW7lig6fKAL1tE14j2qBEBJrMLdsl5DYddea41_MMQ4nhhnnUhVDif0u4yIBgeIDJsRGBjt04jOAlp7U5Q3p5aH7A4BVghuYjFUBo&sig=Cg0ArKJSzAE3zLpxFLYcEAE&cid=CAQSOwDICaaNd6a6LfrW30q5Bomno-2RUqIAB9ULCX_nt5_-9B0s25BM6tD1hOaMpG6u3xXzcany8ajKpCQfGAE&id=lidar2&mcvt=1000&p=0,0,280,956&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2361666189&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701061556457&rpt=1223&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Nov 2023 05:05:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 494B 13 KB
5 KB 41ms
40ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mazhuren.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 35778
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 19:09:40 GMT
expires: Mon, 25 Nov 2024 19:09:40 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 08A3 829 B
559 B 52ms
52ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cb92ffa7aa46230738190e9c780182c4665447606f219b70397366c34296d342

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ZJ3uZj1t0zNPch1yu9Sqzg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mazhuren.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-ZJ3uZj1t0zNPch1yu9Sqzg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 05:05:58 GMT
expires: Mon, 27 Nov 2023 05:05:58 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 494B 39 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 22:10:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24956
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Nov 2024 22:10:02 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 08A3 0
0 71ms
70ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231109&jk=1389033803679421&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 494B 0
10 B 39ms
39ms Image
text/plain 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?SZJFSA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 05:05:58 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 75ms
75ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231109&jk=1389033803679421&bg=!b2ylbCPNAAZxrfrxUa07ADQBe5WfOBj6ZuI0zmhOLrG8Qzr9xFX-IzXsNRUnz3kL6JxMNPDthnwsj30SIxOUHMUr63x9AgAAAEFSAAAAAmgBBwoAjUhlQ-2mQA_5og5ox9z9QkyVFbzbilAIJ_bN5WUtNHFOfk8pO4wPjegR5EVEF5vDBrKvzZvchjKo2I-4hs9Vi1-nf0KSrXfnp7gVKIMkTWlyL6h-Qx0ptWvgaqZWtfXyPUsN2Nw29Ybnl-faMlIWfnqOgPGS0SpfHfQdhae7ajJq3kRExmB7J1WQQtrTc5kCyNoSCUQM-WqY4Rp8EJromOD-0oXclVwk8tyBvviQ6SrQ0AMmFI2Z38RVevOxXI9imWXA1uUSbv47mL99RsAx7FfiNLKL12b-kUOfEPdGzQEi1si6QKy9eNu4EAPHDEugkCqGeTLtPnmdEedtmi1YuHB9k8BoxIqOwFqql6heMn1W9U50UsTDpD_31NMkiD_BOi4LPxkRnX9d1T1Nw2Wpkbyy8KklVWhXqhQChymZ5oLvQwaJ6q6fANJlRqyKnEPfNi9d-I8WG_G2nxXfON_hSzQm8IKqZwsayPjd94OGih4YQzmO3DLsInFxVTAbHYEA0zbZN1hw8jpGfOFRUovBtGDE2uNABBU4Ha6Z3vF1pd8LRkdHYKK_cZIQ1mk1TTm4tjL_1WkwtFtujlJ74s0L3DFOWf4zHi6Pfz89g0jLCX2qzaMraU0KcEAyCnTJ9JqMgyRCJInxjl0ppjoDGuk4jnyvOutTpWOLPF5EvVWS48lYE2W22v4U3zVTL-ag2c_ginkWgyjftEPifTJz6JnePmpd_XwLW4dOlYwVvWKOJ4LIY1W_UxNeAarb4O7WtUCztYej63zGxZQlHEwHqI1YJWOcscdDrLEEfitF4alCUPj0ymHVZdk9FnwU7iwJhkzxHJx4r7gL_iUsdqhC3LwM4FtMccM6R3LdunoQ--4KaJsjowENEdndzN0Xzg9SIEIOlG-fC6Of8XzgllaKvg7upw0jDNaA2QVnA0calLPiLbYSUs5EvxRox817JC5SKdLygTDILsf_gg7oVozKahaOSCH-M3bSVB1cBlnnranWdu2lRWUbXpl3V-y-3cXudHTZCoLSda_NRyr3O1b9uFijKOREjHVUYQSfh1zsaHo4HFRtZjwCp6dRpjLyyCfOqTifA4FKh2HskshrWegn28k5juG2dhzdULlXxXsXRVeDDVFFJB_L9sKoWGY
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.mazhuren.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mazhuren.com/	1970-01-21 02:07:01	Name: _ga Value: GA1.1.1535369883.1701061555
.doubleclick.net/	1970-01-20 20:50:13	Name: APC Value: AfxxVi6HEV02MJw5IC56YZgqmxLDD4989wnok05thkr2EQdfkZ78mg
.casalemedia.com/	1970-01-21 01:16:37	Name: CMID Value: ZWQjtNgpFFBbLDhZkwq7PwAA
.casalemedia.com/	1970-01-20 18:40:37	Name: CMPS Value: 2179
.casalemedia.com/	1970-01-20 18:40:37	Name: CMPRO Value: 2179
.adnxs.com/	1970-01-20 18:40:37	Name: uuid2 Value: 7528111136616987893
.mazhuren.com/	1970-01-21 01:52:37	Name: __gads Value: ID=9d58eab7c7c8de9e:T=1701061555:RT=1701061555:S=ALNI_MamZZk4HTh_CxVkVdItb9k44SnP5g
.mazhuren.com/	1970-01-21 01:52:37	Name: __gpi Value: UID=00000cdcd609f3fc:T=1701061555:RT=1701061555:S=ALNI_Mb4G4Hr0olnciw8FQbmvqiXLyS54A
.adnxs.com/	1970-01-20 18:40:37	Name: anj Value: dTM7k!M41.D>6NRF']wIg2ImIHwITu!@wnfH8K6pQK`!5=E<L5?%KFcYTMR8P?DD/L)(Lj3?uac-+:b@JJ$C%-5e+bpRzqF1`b`0A*4iMK
.doubleclick.net/	1970-01-20 16:31:05	Name: DSID Value: NO_DATA
.demdex.net/	1970-01-20 20:50:13	Name: demdex Value: 07871278488406754531767158430135678413
m.exactag.com/	1970-01-20 18:40:37	Name: exactag_new_gk Value: 0482168fc76d4c4a8f5d30d9093a5cce%7C26.01.2024%2005%3A05%3A56
m.exactag.com/	1970-01-20 20:50:13	Name: exactag_new_uk Value: 0c87ddfac5c1409f92bec75a753be579%7c
m.exactag.com/	1969-12-31 23:59:59	Name: session_session Value: 4459fa0dfbe441c2a604ddae
.skydeutschland.demdex.net/	1970-01-20 20:50:13	Name: skydeutschland Value: 07871278488406754531767158430135678413
.doubleclick.net/	1970-01-21 01:52:37	Name: IDE Value: AHWqTUnAlu8HuSgAjufbOJYzRfwcozDkPc8V2SnirsIgB_sOFvtlqIpVzq1zk-ghfOA
.mazhuren.com/	1970-01-21 02:07:01	Name: _ga_ME9H8EJXQD Value: GS1.1.1701061556.1.0.1701061557.0.0.0
.hm.baidu.com/	1970-01-21 02:07:01	Name: HMACCOUNT_BFESS Value: BB888CEB3EB48D06
.travelaudience.com/	1970-01-21 02:01:15	Name: _tracker Value: %7B%22UUID%22%3A%225BD5EBC0-2401-438F-2BC0-A9E4F1D4F6ED%22%7D
.adfarm1.adition.com/	1970-01-20 18:40:37	Name: UserID1 Value: 7306003755806095512
.simpli.fi/	1970-01-21 01:18:03	Name: suid Value: 0D2066A7C92F42E3AE7D59D4B7D0C614
.adform.net/	1970-01-20 17:14:13	Name: C Value: 1
.de17a.com/	1970-01-21 01:09:25	Name: guid Value: 1.5107400828838849795
.adform.net/	1970-01-20 17:57:25	Name: uid Value: 8953815889030089055
.w55c.net/	1970-01-21 02:01:15	Name: wfivefivec Value: PWcNrlh21R7tOJ5
.w55c.net/	1970-01-20 17:14:13	Name: matchgoogle Value: 5
.googleadservices.com/	1970-01-20 18:40:37	Name: ar_debug Value: 1
.mazhuren.com/	1970-01-21 01:16:37	Name: Hm_lvt_c4f1733c3f4f8121135118be1d428f70 Value: 1701061558
.mazhuren.com/	1969-12-31 23:59:59	Name: Hm_lpvt_c4f1733c3f4f8121135118be1d428f70 Value: 1701061558

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.travelaudience.com
c1.adform.net
cm.g.doubleclick.net
d5p.de17a.com
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
hm.baidu.com
ib.adnxs.com
m.exactag.com
match.adsrvr.org
pagead2.googlesyndication.com
pixel.adsafeprotected.com
pm.w55c.net
region1.google-analytics.com
s0.2mdn.net
skydeutschland.demdex.net
static.adsafeprotected.com
tpc.googlesyndication.com
um.simpli.fi
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.mazhuren.com
103.235.46.191
142.250.185.98
142.250.74.194
172.64.151.101
185.89.210.101
2001:4860:4802:32::36
213.155.156.169
216.58.206.34
2600:9000:223f:fc00:8:48e:53c0:93a1
2a00:1450:4001:802::2001
2a00:1450:4001:80b::2002
2a00:1450:4001:810::2008
2a00:1450:4001:81c::2002
2a00:1450:4001:828::2003
2a00:1450:4001:829::2002
2a00:1450:4001:829::2004
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::200a
2a00:1450:4001:831::2006
3.69.152.80
34.91.62.186
35.190.0.66
37.157.6.232
43.138.202.7
52.223.40.198
52.26.40.192
54.73.183.248
85.114.159.118
85.14.248.71
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf
1b76e0a988eae1a40da171370e2da701669279ce2c241d3fd3ec16cf59e2b855
1c79f82b01a2b1b3df124744176b8ab0ef7879acf39c1ce38fb30172edcb9c92
25b1b4e9934aa4cb8e8bdf5fd7911f6ec67acde6b6b39f1561aec2244f7826af
272cc084414e91f53113d37362088c33c81fd24db9b777c34f473214e8a51959
2881d8eadc298102d2462e8d32e40792adce37b6cd89d99045f574eb3ecbb748
2b4111b56611f39e790138bb704e4951d9d38393f432e696b1939a523d78dec6
2c69b6e5600a9d60ec95edbf3fbddda0fcac1db80f196cea632f39e01c1b5ef1
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
442403f662802cc840ca7cec818685d4b1588509978e8eb2fc98cc195c72acd0
47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4d78ca8bcf83495055bf385f07c42b29d794c260521c2f64ff1ef1207c4b0cf2
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5ffa36b4310d6935fab68e6d90dd0acaeb07db7b7928a3f1416099529a4fbdad
610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
6daac2b50fbb9e55294bf625ab0586b2c7f968de85f30fc288dcea094781d68d
6f1e76c4460d6cfdefa19393f5e03f009f873fccb275686da46b7268513a1ee7
6fe345936fda3457c97b176a6f547fa2d928c23067012747835c5c936793fb6e
70602b2d4f8fd19b95f522d3f3334ada3b3ff4647b4e81c7285b885977fd9ac4
73f6a017831fe5f16b92ac3935faf6c4d85485ce7b4515329c70c0fb5d8a2b5f
75aebd1ba152f0544c46a628e3e3977c95c0f1a38dab803a3de70294d15f982b
8afed81427b3eb5fd11c2528d9fd91151a2831a2b8c0011b5749b0722f1cd9bc
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a
9028b2e840b52cac3c88ad547040153cbf5cc20dd62e8f311254b74c3e5a1c68
9112244cbbfad4bc13571966529c8e0190383351ee91b47a9806c4f0d8678234
998099e420f8d8713a08cda84646ed342ae4fcfaed5d7eb1a29180f7fa19b31b
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
ab80efd0f585e682a41f65cb5e98f66e6243a361ff2b8c1cf84042d612968e88
ac73ebb8340b0f556f027e5480f87e9783cbacceb229f967de67ad213c4b4b6e
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6790f038a116231111ed8cc8d3f11c49ce489f773292246d5f964cadefd4e52
b774a4be3b45ab7c1cbba8d6a4b19bcbcb4e9ebae699b125b05e6f17b6bd57d7
b82aa6c527e41e336e9cd392fffa550353f896f71a3c632a5bdd51e22de4ca0f
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
bc608f4a24b2d6423c4743821986af7d7f3fef1e2b3bf8dc4cf0864eb3c1d5d6
bfb8a517fb615642b5de366c25626aaa92b7424a8a52389a0f1f73de7a66ae8b
bfe3d32ef6f1b54eb76cc6e2afce4e650b8837b29640d99e75e91a2e457e109e
c017841da21bf961e1aa94d3d8b262fc6e1069e4b20dfc22e35d9ade616f2175
c22f74d5ba1997268730300b7d6f6b971f2926cdebd598c77bed9c75369a0f0f
c2e5bfc0e640e9209a63e4e1beffbd68b964b0e101a2774d28b2dff751df7638
c8fdf4cefefc7983b2ba46a8c151d2234b5149a19386ccadf52561c9c679ef14
cb92ffa7aa46230738190e9c780182c4665447606f219b70397366c34296d342
cf1e27c97e82ceea7beb915ab5aad237dd01e7f4d96dd4a1d08b10fccd98fd2c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf940bd2489897434455528323cf66c4e3aecd5eea963f1d99d96acd452d6dd4
d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68
dea253b8b5f9d27bf5fbaa76c913061d6d7970e113d4f516bad3bf88f80c7b23
e229474f67daf83c68c465db8dc8451b46eda59b26ec1e36ffd0f746225c6fd6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64458939113a2bc723bfbb8b11912c876d9139ae95ed113f590b1b7fac50417
ea1ece673616b82840316d3236fc1a02a37f6eb1fcf653812c7117a3c11b315a
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

www.mazhuren.com Open in urlscan Pro 43.138.202.7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

111 Requests

88 %HTTPS

41 %IPv6

24 Domains

29 Subdomains

23 IPs

8 Countries

1467 kBTransfer

3973 kBSize

29 Cookies

6 Outgoing links

Redirected requests

111 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.mazhuren.com Open in urlscan Pro
43.138.202.7 Public Scan

Screenshot
Live screenshot

Full Image

111
Requests

88 %
HTTPS

41 %
IPv6

24
Domains

29
Subdomains

23
IPs

8
Countries

1467 kB
Transfer

3973 kB
Size

29
Cookies

111 HTTP transactions
3 data transactions