wallpaperaccess.com Open in urlscan Pro
2606:4700:10::ac43:7cc Public Scan

Software

nginx/1.17.9 /

Resource Hash

fdb9fffea5759acefdc51f0e2e21320435012b366dd6af855d1e13613f3d24ff

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wallpaperaccess.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:08 GMT
X-Proxy-Origin: 217.64.151.6; 217.64.151.6; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: d85b43cd-bd14-4925-a365-72f718ab7482
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wallpaperaccess.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 248
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ 300 B
487 B 118ms
30ms XHR
application/json 2a02:fa8:8806:16::1460
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_I1Ssr0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a02:fa8:8806:16::1460 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: d5493c1861ca0e8bde6f5b3c6a7b0b0ff65a3a3a96fc76d3491cb73fe6393d85

Request headers

Referer: https://wallpaperaccess.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:08 GMT
server: nginx
content-type: application/json
access-control-allow-origin: https://wallpaperaccess.com
cache-control: no-cache
access-control-allow-credentials: true
content-length: 300
expires: 0

POST
H2 200 adreq Show response
ads.servenobid.com/ 87 B
413 B 164ms
45ms XHR
application/json 176.34.169.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=3281
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_I1Ssr0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.34.169.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-169-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: de5f3b49a3344d8058b775b51eba4aa9684c247f653b0a57ff78de01948d42a3

Request headers

Referer: https://wallpaperaccess.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 20 Jan 2022 20:41:08 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://wallpaperaccess.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
504 B 369ms
124ms XHR
text/plain 198.148.27.134
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.contextweb.com/header/ortb?src=prebid
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_I1Ssr0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.148.27.134 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://wallpaperaccess.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 20 Jan 2022 20:41:08 GMT
server: envoy
cwdl: 22/148,22/148
access-control-allow-origin: https://wallpaperaccess.com
access-control-expose-headers: Access-Control-Allow-Origin
access-control-allow-credentials: true
x-envoy-upstream-service-time: 9
cw-server: bid-deployment-576d5cb7c8-bpwvn

GET
H2 200 pubads_impl_2022011002.js Show response
securepubads.g.doubleclick.net/gpt/ 352 KB
119 KB 98ms
27ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e87e542e34fc3af7847f53ae5c258f82ff2d8739646ed8d249c9a54ede9f7128

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 18:29:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7914
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 121009
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 21:10:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 20 Jan 2023 18:29:14 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 145 B
745 B 104ms
34ms XHR
application/json 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=wallpaperaccess.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-65-9-71-173.fra56.r.cloudfront.net

Software

cafe /

Resource Hash

07952f06ebdb70527549a200a9938ffd7235ca5e0b1782a47ad2c5c832be9fe8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 Jan 2022 20:41:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 109
x-xss-protection: 0
expires: Thu, 20 Jan 2022 20:41:08 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
312 B 27ms
25ms XHR
text/plain 65.9.71.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwallpaperaccess.com&pubid=0cacadd5-7d2a-4f53-879f-72337dd1f3a2
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.71.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-71-173.fra56.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 15:01:55 GMT
via: 1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
server: Server
age: 20352
x-cache: Hit from cloudfront
access-control-allow-origin: https://wallpaperaccess.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: 2chsiW9CGXy98zoJ4Cu7P4BSceQWs7dBW8si9RCLF2YXWFqsuzjciw==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
494 B 60ms
60ms XHR
text/javascript 65.9.71.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwallpaperaccess.com%2F&pid=kQ3zNjyleUKJ3&cb=0&ws=1600x1200&v=7.72.0&t=2000&slots=%5B%7B%22sd%22%3A%22fi-ash-1630503739-9831%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%2221804848220%2C22440675056%2FATD_Wallpaperaccess%2FATD_728x90_Footer%22%7D%2C%7B%22sd%22%3A%22fi-ash-1611843960-8151%22%2C%22s%22%3A%5B%22160x600%22%5D%2C%22sn%22%3A%2221804848220%2C22440675056%2FATD_Wallpaperaccess%2FATD_160x600_LHS%22%7D%2C%7B%22sd%22%3A%22fi-ash-1602347949-8151_60467_59875%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%22175265624%2Fsite%2F320x50%22%7D%5D&schain=1.0%2C1!automatad.com%2C2311911635433464%2C1%2C%2C%2C&pubid=0cacadd5-7d2a-4f53-879f-72337dd1f3a2&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.71.173 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:08 GMT
via: 1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-C1
x-amz-rid: SNDM2MEVVPDV1970VV7A
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://wallpaperaccess.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: V85JKK_8iBkTg2HKc0U01V0nRbTZNdXbWYqazTn9Zf7A653imREK7Q==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 68ms
21ms XHR
application/javascript 65.9.71.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.71.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-71-173.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: L2_MRp8KwiUR7xIWXZFooLHRBfnaqY96
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 66845
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 22 Dec 2021 01:41:37 GMT
server: AmazonS3
date: Thu, 20 Jan 2022 02:08:09 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: cNC-0pQsjkpNSyHIIaEkQC8Mrg1KxJBnLA5-CAqqInHxQNT8fHxh-Q==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 113ms
32ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=wallpaperaccess.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 Jan 2022 20:41:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 92ms
35ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=wallpaperaccess.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 Jan 2022 20:41:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 189 KB
51 KB 482ms
449ms XHR
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3477402087512202&correlator=594917079935433&output=ldjh&impl=fifs&eid=21068767&vrg=2022011002&ptt=17&sc=1&sfv=1-0-38&ecs=20220120&iu_parts=21804848220%3A22440675056%2CATD_Wallpaperaccess%2CATD_728x90_Footer%2CATD_160x600_LHS%2CATD_300x250_Interstitial&enc_prev_ius=0%2F1%2F2%2C0%2F1%2F3%2C0%2F1%2F4&prev_iu_szs=728x90%2C160x600%2C1x1&ists=1&fas=0%2C0%2C8&prev_scp=mod%3Dfi_ap_btm%26amznbid%3D2%26amznp%3D2%7Cmod%3Dfi_hp_lhs%26amznbid%3D2%26amznp%3D2%7C&cookie_enabled=1&bc=31&abxe=1&dt=1642711268857&lmt=1642711268&dlt=1642711267292&idt=1536&frm=20&biw=1600&bih=1200&oid=2&adxs=482%2C62%2C-9&adys=1113%2C67%2C-9&adks=3647397696%2C2802135895%2C1269383587&ucis=1%7C2%7C3&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fwallpaperaccess.com%2F&vis=1&scr_x=0&scr_y=0&psz=727x-1%7C283x600%7C0x-1&msz=727x-1%7C160x-1%7C0x-1&ga_vid=313476702.1642711269&ga_sid=1642711269&ga_hid=1340068578&ga_fc=false&fws=516%2C4%2C2&ohw=727%2C160%2C0&btvi=0%7C0%7C-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

505c780d9244046a9158bf6e06dc1e714f59b6509e5199c014977742b3c76f76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: 217473
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51750
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-mediationtag-id: 452384
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wallpaperaccess.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 16 KB
9 KB 319ms
286ms XHR
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3477402087512202&correlator=594917079935433&output=ldjh&impl=fifs&eid=21068767&vrg=2022011002&ptt=17&sc=1&sfv=1-0-38&ecs=20220120&iu_parts=175265624%2Csite%2C320x50&enc_prev_ius=0%2F1%2F2&prev_iu_szs=320x50&prev_scp=mod%3Dfi_hp_btm%26amznbid%3D2%26amznp%3D2&cookie_enabled=1&bc=31&abxe=1&dt=1642711268865&lmt=1642711268&dlt=1642711267292&idt=1536&frm=20&biw=1600&bih=1200&oid=2&adxs=0&adys=1159&adks=3627485025&ucis=4&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fwallpaperaccess.com%2F&vis=1&scr_x=0&scr_y=0&psz=320x-1&msz=320x-1&ga_vid=313476702.1642711269&ga_sid=1642711269&ga_hid=1340068578&ga_fc=false&fws=516&ohw=320&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a05a63cc1bfff15443fb8cecebbe7dd4a756e74c0a4da2b7b57b19e5a2203fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8687
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wallpaperaccess.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
9 KB 93ms
38ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022011002&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f8b5e01d0b6b620be0d20c0c2fe9ba5e4750f243ef4c79f33c4fe564b0063de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 Jan 2022 20:41:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9055
x-xss-protection: 0

GET
H2 200 container.html Show response
b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8AD6 6 KB
4 KB 128ms
55ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 20 Jan 2022 20:41:08 GMT
expires: Fri, 20 Jan 2023 20:41:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pubads_impl_page_level_ads_2022011002.js Show response
securepubads.g.doubleclick.net/gpt/ 34 KB
13 KB 51ms
24ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022011002.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5132d372cb173a8a03581054f07b694cf11fbdce25ca75e0b9676abeecd101f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 18:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6661
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12969
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 21:10:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 20 Jan 2023 18:50:07 GMT

POST
H3 200 rum Show response
wallpaperaccess.com/cdn-cgi/ 0
169 B 40ms
37ms XHR
text/plain 2606:4700:10::ac43:7cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://wallpaperaccess.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::ac43:7cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://wallpaperaccess.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: application/json

Response headers

date: Thu, 20 Jan 2022 20:41:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://wallpaperaccess.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6d0b1f369a7759dd-MXP
vary: Origin

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 302ms
231ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 20 Jan 2022 20:41:09 GMT

GET
H3 200 container.html Show response
b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FE68 6 KB
3 KB 105ms
46ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Jan 2022 20:41:08 GMT
expires: Fri, 20 Jan 2023 20:41:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0C59 13 KB
5 KB 119ms
63ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Jan 2022 20:06:07 GMT
expires: Fri, 20 Jan 2023 20:06:07 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 2102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C332 783 B
1 KB 177ms
64ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

746096f2fad42ae91e30757ad63b4c9f8dc8f900cb2bc2d049f6423f35cc282f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-befGtsR38FgPU6cg28lA5A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 20 Jan 2022 20:41:09 GMT
date: Thu, 20 Jan 2022 20:41:09 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-befGtsR38FgPU6cg28lA5A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame AF8F 6 KB
3 KB 67ms
66ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Jan 2022 20:41:08 GMT
expires: Fri, 20 Jan 2023 20:41:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4580 6 KB
3 KB 39ms
39ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Jan 2022 20:41:08 GMT
expires: Fri, 20 Jan 2023 20:41:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 80B4 6 KB
3 KB 45ms
45ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Jan 2022 20:41:08 GMT
expires: Fri, 20 Jan 2023 20:41:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bl-91212c4-f67c96ad.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame FE68 39 KB
17 KB 26ms
26ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/bl-91212c4-f67c96ad.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8943caa87c74507a90661f372d8331e42dd41d340c8c99f42cce2fa739a24a27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 17:34:51 GMT
content-encoding: gzip
age: 11179
x-cache: Hit from cloudfront
content-length: 17315
x-amz-meta-git_commit: 91212c4
last-modified: Thu, 20 Jan 2022 17:31:27 GMT
server: AmazonS3
etag: "b72ddc5ce217a9f9b6d4c692bacc1541"
x-amz-version-id: F08SNPw7jZyafuqluqkSYI0rVIGQsQbI
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: XDPbSq0TWEhaPSdBpWT5kCTlQTUhTijZxrBaPUH7fsiIa6nhcoP2ZQ==

GET
H2 200 b-f821a95-2d5d7ed2.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame FE68 77 KB
30 KB 30ms
30ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efc817987705ea0857cd1de7a68dca150a1f749b51fa7e1be582e856b4710cef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 02 Dec 2021 08:21:54 GMT
content-encoding: gzip
age: 4277956
x-cache: Hit from cloudfront
content-length: 29758
x-amz-meta-git_commit: f821a95
last-modified: Mon, 29 Nov 2021 19:05:51 GMT
server: AmazonS3
etag: "e713d8dc2fc5409bdbd2c82f10b97cbb"
x-amz-version-id: M7wQPehQxfldwRKa0wzbry6_6HygtCjK
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: yFlqvbYhp1p7yV6sVw4cXvolDmsSyfoe_YzDPbbfrpV_xQvLVFrk7A==

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FE68 42 B
63 B 51ms
50ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-As_LHpaS380vhzcY8hmSot_8E_uxrU_4yd7C7_QySiCiQ68hDQPo6GCFb2HxGkRqSf7O2j8NiPNMXMsU65_NErfwxR4NpTvtY4c2XYUq3iUFJlW68

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame FE68 0
0

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FE68 122 KB
37 KB 93ms
89ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 20 Jan 2022 20:41:09 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame FE68 15 KB
6 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 149
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:38:41 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FE68 0
0 55ms
26ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQNGzdbbMZuJ2IHAdd9HDI8ZjsGSLwYWfLq2C7FgNDmBLbXLsxwSGIJfacqxVpeU2yoqKuNVguVJjvKKSKxD-eWT4TZ8Q
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 bl-91212c4-f67c96ad.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame AF8F 39 KB
17 KB 35ms
35ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/bl-91212c4-f67c96ad.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8943caa87c74507a90661f372d8331e42dd41d340c8c99f42cce2fa739a24a27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 17:34:51 GMT
content-encoding: gzip
age: 11179
x-cache: Hit from cloudfront
content-length: 17315
x-amz-meta-git_commit: 91212c4
last-modified: Thu, 20 Jan 2022 17:31:27 GMT
server: AmazonS3
etag: "b72ddc5ce217a9f9b6d4c692bacc1541"
x-amz-version-id: F08SNPw7jZyafuqluqkSYI0rVIGQsQbI
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: f-R9OeH5w-b62bkeZqYOgwAYuigW9_N2ff0NFWy1l8HaywxAZdSqPQ==

GET
H2 200 b-f821a95-2d5d7ed2.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame AF8F 77 KB
30 KB 43ms
42ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efc817987705ea0857cd1de7a68dca150a1f749b51fa7e1be582e856b4710cef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 02 Dec 2021 08:21:54 GMT
content-encoding: gzip
age: 4277956
x-cache: Hit from cloudfront
content-length: 29758
x-amz-meta-git_commit: f821a95
last-modified: Mon, 29 Nov 2021 19:05:51 GMT
server: AmazonS3
etag: "e713d8dc2fc5409bdbd2c82f10b97cbb"
x-amz-version-id: M7wQPehQxfldwRKa0wzbry6_6HygtCjK
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Tq-fx7_depzYxgZtjAfhhr1F6wx_UD2vAEIrufteDUcav0gX-a9zxw==

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame AF8F 955 B
1 KB 101ms
26ms Script
text/javascript 37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=52549255;rtbwp=0.020666;rtbdata=Qvcs4Ta0eGgFQyi7htTZkVpsAxrcMyuSqI8YnlgCZexpYhBOfjpigxusCZx1Zf5kikSyMY6XAlwoQbuYHGv2D6CLP-kiS2vrtdwggjl1K1SHjgniZlrPPnxpKthp0qaVDhOuZbkOUtA5_TByqfFF_7eL2Zc0gjdde2k5m1XDx7UVAsxVvZrpaBJxxBeKhR17m0SqVvFbTb-H7bqgKM7E184e6UJ19UI7xOP7EGRkIKg1

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

1384805df0fccee34f5e5107f425bd6ce7874c22df2885d62c309948d95a4534

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:09 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 808
expires: -1

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame AF8F 2 KB
1 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/window_focus_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:36:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:36:55 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AF8F 122 KB
37 KB 106ms
74ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 20 Jan 2022 20:41:09 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame AF8F 15 KB
6 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 148
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:38:41 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame AF8F 22 KB
7 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 08:48:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129185
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 19 Jan 2023 08:48:04 GMT

GET
H2 200 bl-91212c4-f67c96ad.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame 4580 39 KB
17 KB 47ms
46ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/bl-91212c4-f67c96ad.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8943caa87c74507a90661f372d8331e42dd41d340c8c99f42cce2fa739a24a27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 17:34:51 GMT
content-encoding: gzip
age: 11179
x-cache: Hit from cloudfront
content-length: 17315
x-amz-meta-git_commit: 91212c4
last-modified: Thu, 20 Jan 2022 17:31:27 GMT
server: AmazonS3
etag: "b72ddc5ce217a9f9b6d4c692bacc1541"
x-amz-version-id: F08SNPw7jZyafuqluqkSYI0rVIGQsQbI
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 0Y83uc7lb-AA8dnJtAK-QoFHShIz9b1gsmMU6GughcnZBS3W1E25Vw==

GET
H2 200 b-f821a95-2d5d7ed2.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame 4580 77 KB
30 KB 51ms
51ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efc817987705ea0857cd1de7a68dca150a1f749b51fa7e1be582e856b4710cef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 02 Dec 2021 08:21:54 GMT
content-encoding: gzip
age: 4277956
x-cache: Hit from cloudfront
content-length: 29758
x-amz-meta-git_commit: f821a95
last-modified: Mon, 29 Nov 2021 19:05:51 GMT
server: AmazonS3
etag: "e713d8dc2fc5409bdbd2c82f10b97cbb"
x-amz-version-id: M7wQPehQxfldwRKa0wzbry6_6HygtCjK
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Iqk_eK8fG79sW0SyqlFANi1prE6-a1PkS2mVYeql8QW7xf6oKHivhw==

GET
H2 200 14332549318826807494
s0.2mdn.net/simgad/ Frame 4580 14 KB
15 KB 32ms
8ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/14332549318826807494

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16f0a14b50016d182913ec3c232567daf8741bbb7f970dcd30c91cb43baa1970

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 18:00:11 GMT
x-content-type-options: nosniff
age: 268859
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14532
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 22:11:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 17 Jan 2023 18:00:11 GMT

GET
H3 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 4580 32 KB
13 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/m_js_controller_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99f2d327c1ba974f26c36ae210f8e4b1a4711604670aa472f8e5ad4f86996879

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:40:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13124
x-xss-protection: 0
server: cafe
etag: 8348368034461324533
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:40:31 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 4580 2 KB
1 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/window_focus_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:36:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:36:55 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4580 122 KB
37 KB 33ms
31ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 20 Jan 2022 20:41:10 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 4580 15 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 149
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:38:41 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4580 0
0 15ms
14ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQWPCQJ_E7Vt9cmRBDJLaU930vEFW0Rt-sELosZcGLZrCq_rkl0kcHXwQawYZUlmd8GoLCx7Zgi0FqLUJ53vKtUvL0x4A
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/ Frame 4580 19 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/abg_lite_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
server: cafe
etag: 7605774008668088057
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:39:59 GMT

GET
H2 200 bl-91212c4-f67c96ad.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame 80B4 39 KB
17 KB 53ms
53ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/bl-91212c4-f67c96ad.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8943caa87c74507a90661f372d8331e42dd41d340c8c99f42cce2fa739a24a27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 17:34:51 GMT
content-encoding: gzip
age: 11179
x-cache: Hit from cloudfront
content-length: 17315
x-amz-meta-git_commit: 91212c4
last-modified: Thu, 20 Jan 2022 17:31:27 GMT
server: AmazonS3
etag: "b72ddc5ce217a9f9b6d4c692bacc1541"
x-amz-version-id: F08SNPw7jZyafuqluqkSYI0rVIGQsQbI
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: j9Q7jDZS9v8YSRDekWwOqmyF_0uBOg2l2GmG3thc-NTX9iSe009dvA==

GET
H2 200 b-f821a95-2d5d7ed2.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame 80B4 77 KB
30 KB 53ms
53ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efc817987705ea0857cd1de7a68dca150a1f749b51fa7e1be582e856b4710cef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 02 Dec 2021 08:21:54 GMT
content-encoding: gzip
age: 4277956
x-cache: Hit from cloudfront
content-length: 29758
x-amz-meta-git_commit: f821a95
last-modified: Mon, 29 Nov 2021 19:05:51 GMT
server: AmazonS3
etag: "e713d8dc2fc5409bdbd2c82f10b97cbb"
x-amz-version-id: M7wQPehQxfldwRKa0wzbry6_6HygtCjK
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 6sGs5I58t8lMEsIJZYnMewBggVMhTtpafI4vMlLlaSWKmBfzLvmpaA==

GET
H2 200 css2
fonts.googleapis.com/ Frame 80B4 4 KB
1 KB 74ms
23ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 20:03:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 20 Jan 2022 20:41:09 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 20 Jan 2022 20:41:09 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 80B4 205 B
743 B 46ms
11ms Image
image/png 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 02:24:49 GMT
x-content-type-options: nosniff
age: 65781
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 20 Jan 2023 02:24:49 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 80B4 604 B
628 B 25ms
9ms Image
image/png 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 19:27:53 GMT
x-content-type-options: nosniff
age: 4397
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 20 Jan 2023 19:27:53 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/elements/html/ Frame 80B4 18 KB
8 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b277171297bfc840b62b9f160060bf8fc630389b0dee3aadcbb0e855ac7ecbc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:31:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 584
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8104
x-xss-protection: 0
server: cafe
etag: 11153116566150069083
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:31:26 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C332 0
0 84ms
52ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022011002&jk=3477402087512202&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js Show response
pagead2.googlesyndication.com/bg/ Frame 0C59 35 KB
13 KB 47ms
17ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4528ca9e4e601b97be627ab26a891a181a1f44161c990df96f9996037005ed78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 16:38:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14552
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13497
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Jan 2023 16:38:37 GMT

GET
H2 200 pixel
googleads.g.doubleclick.net/xbbe/ Frame BA78 624 B
0 33ms
32ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY_IGqXTAB&v=APEucNUj8tiS4XTaUtooe8ViZsQZqDZq0NAQ3BuErIwhGiufpKx_M0BYCWNSsFgj86bWnPMzIuuzpsqoN-F4hQE9vfCEi66Ohmp0V7HN5fbXBnz54r7Ks988VCWPlYjAd7VVlxwuqylyTfyX8BhcxrFMraL1G30JxGK0xpMJGeUffEE6o85ebm8

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 20 Jan 2022 20:41:10 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 20 Jan 2022 20:41:10 GMT

GET
H2 200 ad
googleads.g.doubleclick.net/dbm/ Frame FE68 25 KB
0 51ms
51ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cld83110LlwykQXuv399A7AfClV6nxwytLqIRDSvM4C8OKZqV7wx-2borG_h2DtwhZNgeVUpoIV2Klsaau-K3KotD91FeTZk77tHiHzp6oY6rXHPNCbq0VgMnAsxTbQKq60j2hUq4iA6UaSHUSSqEYrPX42A&cry=1&dbm_d=AKAmf-AcDHJb79Xhr2tMgOUfCKdmVOac0NXYQlCMPAdCVO97cnrhOJxhLefmfVzaIIAWGFjJlXB-RTb0eD3dCGGartf0AVZDzPNEh7FFMBqi5GPJlEgUQP05KCGazm__my0i2Kx6guBb8kO_Hs6Y1JZiE6Q3_cXo3mGJDXILa8Z_C8OhQxmWM_7P3-Hs9kRV3x065ONdhhW29_040dQmjRpkcCFyIiDBPeb3wafjPgI1c27Lugz1RcZonIUml5LdPGhoWLV2mQ65dOzrn1zFpOwJOCVHfixjGegF93Omi0U8aQXMuGQ1GL0nn9ONaxq4ycu0h96rNzSUcoOHOC9yvoLO0yKyuj7hicNl7ZmJ-Q_1HoTg-aaQyRYKYiM7kFZMPvbQ6wT2ZGc35uGXk6BchjKlGyITO1sVpqwX7gnr3-i0SqSwogTfVwS-vNWQ2HofHeWjh_82lLrd-9J0D6OuoI9ECtlVxxgleYQqVv6USQq9HN79kEXRfvzsRn4c3-ZsoNn4mhBbE5PJvQYySX4t8zsioemDg_JNESHK3uM2Cq41H42aV09vh3dsuAXRlCbPOyFKqzuKz5illS_yMPxKYZBjbZ6vPvLxMqt-QFHQprDn2_qmANkKFIE9v_stvoZ5Bqgjm1qpNkGbcfoHOrO9bQKtIQDInpTteTdbvfoNc7OKO2G2vs2hzayxAjOTl4VedKImiHQdjYnQ1W5wglZNkf5zI2uVL-mfTanLM81VmyVaQ-7Ah98RnsJ5tA7SOOjlPHcr2cVL9OJzCgnMVn6Rz_K0tYCOkoUWOheG83kOjIJOr6YWyIy0CbnnwfjV3IgFB2dsQ6_HBoQNzWiDG3o8urZ2WMfxzcscibLEj8Y1CfSJW-qiQikXdzNudu_4U66cbdFK-6jwWnaxMZpQSeAc2KXINbI9KHlDOG_Qb0DAz09SBp1E-S--doZ-YEqNkvD5U77n6MBJz7s-nJjMV1VEvEyqEm8KkhJuaUm4DCKuNVKlvct9SCLdrrLFmOfYa7opvdEzKJqMACkYrUjpGC_gNlsKcpOwC9qtxsq-03GaTLPxMxsgxgTE5Ahgnk_fhFt5VW7qFXGW4_tX0_1w-HpFLXeOnDuyR1dfgOIlrGqCg_T7lZuGDDgaChW8uU9FZuRGmSR9vSo-QoFOS5Pevicnr3isQ_XSKdvsgvdw4TnPCW0qkUA7pKeT-s7I2yVg-oXDYzvjMwA2voBPSHzPWPuSxR1zl6zpM-VDl7qhpch4JNG2MckVoVtUc2uuM_7822zlbzG_OAWEOXHyEYx1KdrLskgCyWxYZ09qw1PRLgWWcTukv_-ODYWR6pYrmCK2CXfmtAySZIwhyKQ72AYl1ZrOFJIphU_0-D2k3QWHhZs2ZvTusP1mNMUbHtNLWf4hJPg4G18t4w81a9FkO0qc328dzJ1P0SQcxzALNuqK1ClweRECPSgW5_ZQe6cTN2cABGtVEco3o8IH_ELaP2eSd4a9zruhKOM_9wmC6DCR6-1RZwxCran4VZL6UySddv5gOmNrpE4fOsBpx98-9Yyhm2-FxQ25V3XVGBNT5nrTZrduS5wshRXwFygdx0AbxRjw6JNYCNsweNIF4eqhD20paq0lkqYbOHwrmrUNA0uUCUYF-d2BM7qf9-sIfB45DBpnWuORy2Vx0JZvwcXldbDJJcCKBuP1u8hUjHqjdR_JGqtd-5Mbe7JQ0b6V9bgOVCJzqBXjwGim1ucK2K7Z10rouRf565UzVCMZcg6ugxzbllgViNB30-LWpF5xELsRSlW7v-4A8hK5NRDsZ6xmBYRsejLBICRkfVXWDoghnRJxg__0YZEA3EDwm-JqnjgBmZDESTOfFsl5rWD2ny-trHkELR7jrle5C_R9OmYfZpN2nuAG4ckWxlBKf21seYFTalZYkma1WpscR3XVhQ70l12GTk9pDbLXYnJt3VWYJU4SVUyLFe52VS-wSH4DF6GghVxNh0OJxjjWbsfIqyRVokjMbuyRxi_2zR0R8-1Ry-DmWnFtH3vmitO9GtFC673BgaTM82fysCKFTOa1sFdjA9V-7-TC4W4OGbSOADoYwd1rBCoUdem9M5miVxRbYXKM3xICU7p-21sYw4VdS9N_x7BB-JRhiBOUU8p0E_XhWrc2kvKFDLUDdEa_StTGAzICSyiSwFnit1me_fdayJPs8V06pgakxDxBIsApM9s0wht-PIrcnvyfpSd4k8j48TMMAKHS-CZhx2ljU544h8Tn88WjX_7xq42JyWQXywb5iK5S0BVlIwmMdgTn8a1yRxvaaFTn1BbkE7tu6B50uul66A9x48QKOt1TN8Av8fiFVCsAc5QqPFENqWOei3kFM_V7jM9pc5bKU8V7lnonik8F9kDomUB9kfXJ2K4Ad0g9ib3cZiZuhTKPV0-2l9LtKQDPto7WNgr-Olld5SPjoXX_PEVQK3okSgreoRQhH04Bg81mKiGO3TpDouY5fCQDfWRfdIZ5PH7Od0WRkVJUjCEWrLGwiqSaJh5I-RvDWYEX8qGBUyvGTXyIlEiJUXHswb80x6_gmvZb_Th2ze0oeg75WovqwBtiAuqBxdm_WMWII2ibPSaRDCYjESC56v_gkcJbeSkfd1UdH8WqvNyFkwCmErAdcTYrcXOYCjeECHqwsxfqsU4tTfT9HYB0Un7VevXVheXWKJHvVwYJyeFBsTRTYbMs5KkLpi0Ie_yPcL4yVuQTXKuHEiIilZHVI2I9Sk1wzZ-lf9Kz5SD-3jmG6DIYbcg9jTdfA3ZZlRiFwKwqbEITBOaSAZMqMU4IwpztRhyjyBiEqfCv4d2jVlXdZwcbaAcNx39khUooAlT4WBSDF1_C_lIFBOmSzd_cRYF3rLRT6hfl4V7tdzs-MfTDI2_hKs6o7RqV2W3Pt7q7_xpRjUqUxfzu-JNggLMjwYSQ3jITleZjfsgLwSf51CFu1shcHAknPhy48jkI0TgJnw9ztrC2szE_exdkoAEFuma0ULr5IJLYDEZ8nzfZKkfAZyFs2ldPfdn6hXTRXcZTQOnAjB92RPVuXVDP8yBHbkYuxq6IIyVNAPHUT4ZnGx_N20e_e6fQn5YOAZg5Sy4QqYTdQe11KoV0sUXmYS6VK6qEtXyfWgKr2Tgwl5PQ0JADgpIrNpPfgWHmHciygCFRWumE5mOyiCGwPZdky9LgaxOUjho&cid=CAASFeRoJYhmD-uo1pWprxTkW105rapzgA&rfl=1%2Chttps%253A%252F%252Fwallpaperaccess.com%252F%240

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15473
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 40ms
22ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=wallpaperaccess.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 38ms
20ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=wallpaperaccess.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 52 KB
20 KB 445ms
445ms XHR
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3477402087512202&correlator=2871873742521249&output=ldjh&impl=fifs&eid=21068767&vrg=2022011002&ptt=17&sc=1&sfv=1-0-38&ecs=20220120&iu_parts=21804848220%3A22440675056%2CATD_Wallpaperaccess%2CATD_728x90_Footer%2CATD_160x600_LHS&enc_prev_ius=0%2F1%2F2%2C0%2F1%2F3&prev_iu_szs=728x90%2C160x600&ris=1~1&rcs=1%2C1&prev_scp=mod%3Dfi_ap_btm%26amznbid%3D2%26amznp%3D2%7Cmod%3Dfi_hp_lhs%26amznbid%3D2%26amznp%3D2&eri=1&cookie=ID%3Df4b1fe591b28e628-22be76b825cd0023%3AT%3D1642711268%3AS%3DALNI_Mbt6frkWjcxMcXihoki11bEP10ttA&bc=31&abxe=1&dt=1642711270265&lmt=1642711270&dlt=1642711267292&idt=1536&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C62&adys=1110%2C67&adks=3647397696%2C2802135895&ucis=1%7C2&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fwallpaperaccess.com%2F&vis=1&scr_x=0&scr_y=0&psz=728x-1%7C283x600&msz=728x-1%7C160x-1&ga_vid=313476702.1642711269&ga_sid=1642711269&ga_hid=1340068578&ga_fc=false&fws=516%2C4&ohw=728%2C160&btvi=0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a700b277933bd6fa31ddf5073159101f7213e982b45c66f63aa88a23ccfa3010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20223
x-xss-protection: 0
google-lineitem-id: -1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wallpaperaccess.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
10 KB 270ms
269ms XHR
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3477402087512202&correlator=2871873742521249&output=ldjh&impl=fifs&eid=21068767&vrg=2022011002&ptt=17&sc=1&sfv=1-0-38&ecs=20220120&iu_parts=175265624%2Csite%2C320x50&enc_prev_ius=0%2F1%2F2&prev_iu_szs=320x50&ris=1&rcs=1&prev_scp=mod%3Dfi_hp_btm%26amznbid%3D2%26amznp%3D2&eri=1&cookie=ID%3Df4b1fe591b28e628-22be76b825cd0023%3AT%3D1642711268%3AS%3DALNI_Mbt6frkWjcxMcXihoki11bEP10ttA&bc=31&abxe=1&dt=1642711270267&lmt=1642711270&dlt=1642711267292&idt=1536&frm=20&biw=1600&bih=1200&oid=2&adxs=0&adys=1150&adks=3627485025&ucis=4&ifi=7&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fwallpaperaccess.com%2F&vis=1&scr_x=0&scr_y=0&psz=320x-1&msz=320x-1&ga_vid=313476702.1642711269&ga_sid=1642711269&ga_hid=1340068578&ga_fc=false&fws=516&ohw=320&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3e5c5cdfea7214e933e789a8550e3e634d519c37a0b1c46013b016e551b809b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9709
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wallpaperaccess.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame AF8F 0
0 47ms
46ms Fetch
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CYDKP5MjpYYW1OtqBx_AP4qu_iAW4mfOiXOm17rv6AsCNtwEQASAAYJWakoKgB4IBF2NhLXB1Yi04NjQ4NDMyNzY5NzQ2NzE3yAEJ4AIAqAMBqgT5AU_Q4kkmF-LzmQBmr1hF-dIKbfPl-PRzVBSjKz4bTIJov1EsLl7nK0AUrgmgeJTA2D7WLz2UQ_OGPwLxDNgy5bc6shDHk2IuDIS4zV7NyNByS-hrjZ5xhlhtThL-wYnqGGlFdudrJgjOcoaOXqhbqi-YKmFcUDWd9VTr0hNADRfY3EsFhv_3zo_UXRIo8z8sW10-wyqairBD4HEtVHCkcRgIKO1Cpxb_opPjqUvg2SSgGXDOnDW8p8D6eRdgCcTpu-nfWnXmyr0UqmUvVjJrjHm3Se3sChv2fk8dtdIonPAe5E0QiRCOq9Pz2XvS-QIzKctrHQL9JJRfpuAEAYAGpNH0ibKF15qMAaAGIagHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0xNDU1NDkwNDc5OTAzODczgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTg2NDg0MzI3Njk3NDY3MTcYk8Jw&sigh=j_0h6RaK18c&uach_m=[UACH]&cid=CAQSPwCNIrLMrP98GMLhJ-3YxemhKpLd7M9bdZE11OM3Kc6DxJo_qm8bFYZLECoioDYZlV_YSJ2NUn4dIdYe7b5rBhgB&tpd=AGWhJmv36kGGN07bNjDZ7-DLrdG57PUblwKLWHRummLHdsbC7D9Keli-OndwCIhNA84AjVjuf9WIVAhwkyzQVwCiEQFPAApZhRu_BIqUyMcoG08orrfr4jz_LtTzM3QDPyjNv4eym3Il8dSjDZe_jzt8aAF4XAPix1JbouRt1m2U5jdGYTHuNW0-O7p38iJtPry1l3GvA3Am-KXYpU00NKUsAgmHl7ryflxv8BwKyL7pfWu64jct3FHTeEizisL-OAMCBX5tohPkUPDLOVZR-9gmSTyZOHcM83zizV83V-3y-Rk8lqatUWEZSFDiE9brrPf4n9Eg7pIJ3VCaXWn8_XIzeLaDfeqabwB6jPgg3o0KKWSb6J_TEyguik-gKgs65DsYjk1DUu6_KOCL3xOTzXI8eDUwx5ymTHTh0E-yQMKKw79gKnWgra_Pt5frNkcvYVMxexvtPs7RC6Kyd_vKbgYJLUyqj9pDoxYHyOh9ChOmYmM0fBJ0AF4_7ss59drtEM202eNf4XfRPBiRt70s3xc14u3avskkZqLYio6Ka9Uexh_1LPmhlSoc1OS2H0dGOLlFqw4wT3VZcORMuN6-9NO5jBdjFoWFXCm_uwaEwY_1uD9OiJcoYP6KqOFWqWDw2k6mZ7IRorvYbKAyqzzI0GylPx0VsHuOZevWRZrdM6E4bpXQK1yWZKZP05QlZ8HXjAY63sB7Xd-AI3n4n2tVDGvL9iAmHentEUAJGPQ7LG4xbdl7vtglKqAZjEkRPBGC324PU0svgGyfJamF9hg5ZrsC-H7n6e_imlckVIe36JqBj7D_WWwESvFg5meaC0abHEk1DQfpYt_SW1WrmnpFnbnoAh74_0e9Oxippi-58F7sq8yl0bMzDvfC-NLocMpd_B2yOgM37Yu1Wi4XSL8VKjue_sStFPJs-C3XM2nyk7jAX0Dlae3XguPbijngfO2PCoIYSQythRNf4WYFFBlEx-yUEF4TgQ0DWRylNvLEXOpuLitBBrW8OYL_tH2pyW_BHg_EdNuNvAhGSkDK3nenGX48F9-lmVS08YHqrG0livtx3JiXbPjT-X3WsfdnwOO3_4f5PIXEpilfP8pFlXAyLpoSfwDp07FwzAA5yYr-bn0pRCMvtUsxX5Sjs-JzqtqptY4Xgr2xD4h8XSQUjZ1O7kV4BvBbVSkfVL1bZwKpVJSL5SsIxSPVKttf7D3Z69f3FdjIRjjRmP_IULBg_XZKkMDyBH8ZFlE9EfSM7z1eRl6CPrsrQt5B7qHk_-G8Al7I5S8YQcEbNHX2prsGHlrhfjQZwoZ5Ec_CNU61Dm-Y5mcurtKVC6L_ArbLKIIwBA2cZiiuFPmH_odi6NOtri7hq0VnxxccvfBqi6m2Zo_D2HXbkMjG2QboqPnPPIxXRTgvfACfYm0J1Q7eSZ97K9pND_4KqjWIXOxHOVp8219Oo-n9erpjV6MSHS_roTF-PaAIR4AAm0SNuboZMcD3mUU8PzlbP74hP8fn17HuZhqpHeWXdUO4uNR4oYVVIzc
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame AF8F 33 KB
16 KB 84ms
18ms Script
text/javascript 37.157.2.249
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.249 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 0ae298f2509111b6eff0a258cb53fafcd63adbacfef38e453f46d7ff50edc24e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: gzip
last-modified: Tue, 18 Jan 2022 09:30:48 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Sat, 22 Jan 2022 00:24:40 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4580 0
0 75ms
50ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstRkjyPVK5aGpj1P65DIbGPj0TzD_FV0Y4xoVmRiT0HlVCFI1TEiAT5aVhdxCjDrTPrFguQOK_1JR1pl683ExsFvYgY2iizINdyqWvYnGhorw4TN5YjWPFknRtpuQxJGuumnPYGNgTQ-68P35VlfVUj8srnncn_MSZKY1v_6cIf9qMa2URVNLFhoOIqDA8tr6wVUNRr7MWR7Q10xlQBfj8M-RwEKfIgV0bzQwDYN5FWuMmkJoDED8c89Y9Gj3bDmvv_oi89Ms6ZHkeKRub9Y6ACgt3JCwAX_v1YNj_6tUzF5eaBRy6-7A29McWvnddSp71_5TKtFqRNesjc_zCXn0Ke8cDKB2kU5_c3ICemreCVM_FNJsK7DyMZaSra9P-3CVkkuK5IlmkWncxqv-5stwe7cxnJOk4ADo5mVMUDRpr1h_71gNB614UgVvXI1_3L89_Zv_HBxInMm-N0ZeCsoDXDUcQR12B0wBiV7808QLc700la5xNa1Ula_jsRAVHHQ3r5tjtrVypCxzKwq7HhDz-9Zx1Gniy9vtF7Gw60Q6wkr1BCGYq5tfpjuLtW1Bme6pMLtgpV-rOvkOJGY9C9sjkyaAkfJWw5_4c9Q7L82UHVRo4OHV7LNa0mtXgqWvq0mX-noTovRlH6F44_vzd0y6AH_r5bcWgLE8Segan5BpQkywdpD1brB762KhmzhfJ3vF1WC5G7aKJIzpMvvFsUq5Km_iju2jEVNWOf4sQRjp88sQ_w_PzKXmVWXRbsC_zZRQGbSHMPuvCxMenxWhzRfTQSeafjDk6NKTLngvk19QRW5FKzSSWTZceeXiwlTvgLTpIaIympPdAEtR1Pe9iSZHFAd04MjxzwHRerWCX7h7VRtI3M9CEmToP7nKGJhltD3EuDCuPPxOvZBIl4HyMBBuRDgDqAT1n49rIuFtptH9KC7Shbe-MQFNzHdlm87fCwgkg3wwP5qw_l6QL_K6epSIbHwYTpnTPZ6R_auOW_I0gWCxaP9eUuqWR3C6haRpD80sVug26HKbcE8lym7UKyK-aYj1zurT_2vS0l-kttB_uYKE5MXjjlQtc16tgo8no92TaX06Cq&sai=AMfl-YRU-yXnERwfXrB5sTliemNuvYDF__AFUc5QfwbdykhdWf47cAuARPlyTQU6Y5kL8L2_-yzbjSLmRFsS4H6w9zl-loEnsmdlG4psSM0R1YFJwO4HY7W5ylC0o7ASIqQgZIWsglU5_kI_qf3zvbPhaaCxB6g&sig=Cg0ArKJSzBnu28Wd6furEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 20 Jan 2022 20:41:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 4580 41 KB
0 9ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 08:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129188
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Jan 2023 08:48:02 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 0F48 6 KB
670 B 34ms
19ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 20:30:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 20 Jan 2022 20:41:10 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 20 Jan 2022 20:41:10 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 0F48 1 KB
876 B 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:40:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 848
x-xss-protection: 0
server: cafe
etag: 2277666839114365613
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:40:43 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/ Frame 0F48 19 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/abg_lite_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
server: cafe
etag: 7605774008668088057
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:39:59 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 0F48 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/window_focus_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:36:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:36:55 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0F48 122 KB
37 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 20 Jan 2022 20:41:10 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 0F48 15 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 149
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:38:41 GMT

GET
H3 200 fccbdb50d0e11463e1edb3d8fcf7c364.js Show response
www.gstatic.com/mysidia/ Frame 0F48 27 KB
11 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fccbdb50d0e11463e1edb3d8fcf7c364.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1b3a51250ea5d2b293615f08241269ed8277b95654cddafbc0f5df8d61e6cc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 19:23:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4656
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11411
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 13:53:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 19:23:34 GMT

GET
H3 200 container.html Show response
b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 55C0 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Jan 2022 20:41:08 GMT
expires: Fri, 20 Jan 2023 20:41:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET /
track.adform.net/adfserve/ Frame AF8F 0
0

GET
DATA 200
OK truncated
/ Frame 4580 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 47ea979a92e0ae23440aab9c193ca040df4501ec97e20255811f31993da5d07b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 4580 0
0

GET
H3 200 container.html Show response
b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 35E6 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Jan 2022 20:41:08 GMT
expires: Fri, 20 Jan 2023 20:41:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C7C4 6 KB
3 KB 15ms
14ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/op.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 20 Jan 2022 20:41:08 GMT
expires: Fri, 20 Jan 2023 20:41:08 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bl-91212c4-f67c96ad.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame 55C0 39 KB
17 KB 26ms
26ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/bl-91212c4-f67c96ad.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8943caa87c74507a90661f372d8331e42dd41d340c8c99f42cce2fa739a24a27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 17:34:51 GMT
content-encoding: gzip
age: 11180
x-cache: Hit from cloudfront
content-length: 17315
x-amz-meta-git_commit: 91212c4
last-modified: Thu, 20 Jan 2022 17:31:27 GMT
server: AmazonS3
etag: "b72ddc5ce217a9f9b6d4c692bacc1541"
x-amz-version-id: F08SNPw7jZyafuqluqkSYI0rVIGQsQbI
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: LPTRcgAU4HTDAauYOhMKOdmRdPa8dflUZelY2qeGQpuuXwkDr9R5Uw==

GET
H2 200 b-f821a95-2d5d7ed2.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame 55C0 77 KB
30 KB 27ms
26ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efc817987705ea0857cd1de7a68dca150a1f749b51fa7e1be582e856b4710cef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 02 Dec 2021 08:21:54 GMT
content-encoding: gzip
age: 4277957
x-cache: Hit from cloudfront
content-length: 29758
x-amz-meta-git_commit: f821a95
last-modified: Mon, 29 Nov 2021 19:05:51 GMT
server: AmazonS3
etag: "e713d8dc2fc5409bdbd2c82f10b97cbb"
x-amz-version-id: M7wQPehQxfldwRKa0wzbry6_6HygtCjK
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: mYsRV6m7xoSnnVMICKXLjAD0V-QshQu5m7CSEZGT-dAJfk5kMJQI6Q==

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 55C0 42 B
63 B 41ms
41ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ARINSccaLd4T6I1I5pfgImF0XtpbEKwiF6KS346ZI2AFrKuDaAIQokthtTwOHKcPiuxR2MuMjhnqTDBOkZmw-NmXI5HLVhfE8h0qbgBhnQsxuoa0Y

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 55C0 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/window_focus_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:36:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:36:55 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 55C0 122 KB
37 KB 82ms
81ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 20 Jan 2022 20:41:10 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 55C0 15 KB
6 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:38:41 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 55C0 0
0 14ms
14ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTqK6vrY4STM6Z8e9gOQkC2a6DyJ_GDiOEcz_oHLuxy_3B-WbYabywiGaV4_Bn_uH-cvO6YUBIXVrAKM2Fb6DMh9cK-Wg
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0C59 0
9 B 23ms
23ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?TsAcBQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 bl-91212c4-f67c96ad.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame 35E6 39 KB
17 KB 24ms
24ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/bl-91212c4-f67c96ad.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8943caa87c74507a90661f372d8331e42dd41d340c8c99f42cce2fa739a24a27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 17:34:51 GMT
content-encoding: gzip
age: 11180
x-cache: Hit from cloudfront
content-length: 17315
x-amz-meta-git_commit: 91212c4
last-modified: Thu, 20 Jan 2022 17:31:27 GMT
server: AmazonS3
etag: "b72ddc5ce217a9f9b6d4c692bacc1541"
x-amz-version-id: F08SNPw7jZyafuqluqkSYI0rVIGQsQbI
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: DWaYiLTYIDnwZ0GICUzebShSKse9STsnLDPcU_4VEEZlSwL8RtTAlw==

GET
H2 200 b-f821a95-2d5d7ed2.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame 35E6 77 KB
30 KB 24ms
24ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efc817987705ea0857cd1de7a68dca150a1f749b51fa7e1be582e856b4710cef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 02 Dec 2021 08:21:54 GMT
content-encoding: gzip
age: 4277957
x-cache: Hit from cloudfront
content-length: 29758
x-amz-meta-git_commit: f821a95
last-modified: Mon, 29 Nov 2021 19:05:51 GMT
server: AmazonS3
etag: "e713d8dc2fc5409bdbd2c82f10b97cbb"
x-amz-version-id: M7wQPehQxfldwRKa0wzbry6_6HygtCjK
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: L-37-dtcZdCpE9z3X-a1CCiexTk_0SxF-LARYvmYl15TeJ4OeQFGLg==

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 35E6 2 KB
1 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/window_focus_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:36:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:36:55 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 35E6 122 KB
37 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 20 Jan 2022 20:41:10 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame 35E6 15 KB
6 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 149
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:38:41 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 35E6 22 KB
7 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 08:48:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129186
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 19 Jan 2023 08:48:04 GMT

GET
H2 200 bl-91212c4-f67c96ad.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame C7C4 39 KB
17 KB 25ms
25ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/bl-91212c4-f67c96ad.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8943caa87c74507a90661f372d8331e42dd41d340c8c99f42cce2fa739a24a27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 17:34:51 GMT
content-encoding: gzip
age: 11180
x-cache: Hit from cloudfront
content-length: 17315
x-amz-meta-git_commit: 91212c4
last-modified: Thu, 20 Jan 2022 17:31:27 GMT
server: AmazonS3
etag: "b72ddc5ce217a9f9b6d4c692bacc1541"
x-amz-version-id: F08SNPw7jZyafuqluqkSYI0rVIGQsQbI
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: fOAfAI8umwocQSaKxC73MqkFouoN3uizqFA0vk__bs7jdFCyH7OIbw==

GET
H2 200 b-f821a95-2d5d7ed2.js Show response
tagan.adlightning.com/automatad-wallpaperaccess/ Frame C7C4 77 KB
30 KB 25ms
25ms Script
application/javascript 65.9.58.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-58-31.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efc817987705ea0857cd1de7a68dca150a1f749b51fa7e1be582e856b4710cef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 02 Dec 2021 08:21:54 GMT
content-encoding: gzip
age: 4277957
x-cache: Hit from cloudfront
content-length: 29758
x-amz-meta-git_commit: f821a95
last-modified: Mon, 29 Nov 2021 19:05:51 GMT
server: AmazonS3
etag: "e713d8dc2fc5409bdbd2c82f10b97cbb"
x-amz-version-id: M7wQPehQxfldwRKa0wzbry6_6HygtCjK
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: bpB3U3yYecBr6hAOO81gFy2qNvMcVACBCE0DElpUVIxjMoOGjsWK3Q==

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C7C4 42 B
63 B 148ms
147ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BM7mTXdBlI_Uqr1vaxEZiyEdrFTvfDNhvEwiBGp6vCroK2NlKAEC9G15volID7q0DnroGOcZK9cdIM8oQZOKu2SOYaUn35W0BTIhBk_TdCoqR1JX8

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/906442/60231624/xbbe/creative/ Frame C7C4 237 KB
80 KB 151ms
76ms Script
application/javascript 54.78.76.208
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/906442/60231624/xbbe/creative/adj?p=APEucNV-xLlqC9OGnCOOmSz9HkDiTGez7DWQCKux7c3WB6C6lEfKk5o&d=CnkAoCZ_4G9vGb7_Uw5LAsrazxLygf_t-oYCB8QpgBmIVmqKKvL-hTNl1LSUfGCbbFaFSONufN1YwAlwjLTixF39Q4A08cne9HVIFeGR-owlNNzGmnS3bH5c34HkbxNsm7Z7g4xOad3fnAU6Izb24bMJQdOzTLM_rhIBEvkRAKAmf-DihmKLM9Pjs8nd3wSkISNUoeXYAoEmUWza5iMwqaSn0Pv6044iTN0V08tygujAdyYYKyA6TduOaNpmUe6a01zuYxqS37fEu8ig5JXqUxCq77xP9cUrZStiCfEszloY7Edm8n0Yd7WB56dSG_ljd6JqjtvxqUWFMWZdG7e67d1eN611vbq185OcXsPgZangwtxHw4NKuGH75yjX8vA6GVHd6WgbMMCrjeU2WG-2Ot5KoHgFVQi-EPxgP0tBc_eIOF8uN8PCseZs6qXtW31y7KkYMs2HR01A9kCXXZc1AGYUP0O-gFRvhhjxhfVkMypCqWoiPAp_I14oGxcSwOXBfmaUKYviFeFJPxe3Sd2mbIkjStWH8LrR-vDSgCUvducREks2fMyYZHMfkJGIyw8dkItQTrJeqRPwZMT_UnJ0iT9Dq-FoU15O9FL0b6wWNhxpaCIyNCESO71QQbvLaAtya1Jdl9WDb7QEv-axM0SY5uy3j5YkUYLE_aIY5YIJCHi953zWTvgkhwbCoL1ShyJ2401RBxriKh8TzaJ9IJ8yDq33zkrGj3JkQ01x8oEtxgILR6KVb8Qqb3UBuIh94dthVs1OqxIspQvlFoh6Jl7fJhKETxas2eMQcmS1HlNZN2JI13q9gaIpvI6gM0jTDBsZVWhtmZCTp4jPvsBSo5e3LopncaTLUeX1D3AuekxH8eWgPbRNnfa9jSea7qgXhSPi_YPV-4jkiJasKIeCUtbRhO22JpuGMmd59RVa6VgUIQo7bVvbqcxt3esky5kj2Jrv1qI9U-ZchSDv2686jdKg0E9xqJC2RGpO-b4XUmHA7FGJVbmmUlLARk10NUyyJ19EQtOEu58EfDnL1_w5pGAIt-mmUvggHNXcymDZGf_zbqWRl8-JY6FMxVZ1XSXZuJMxRBy58OkRKKsgSOCZJMbKkfdaTXhrsK4cCz6g7CbdOfWjKfWHdco1Syh33i1IUB9TCzLLiHdVYf4KioHNvnOH3TKDDk8doGW3aqLjKIBlZ2GjA4PXaC9Uh1iKsvdzYrFBB-krCChd2W3pNMs-fXPhG4LKIVpo5mDEYsj1AiQUt032gx5ef3HTF_jfsgmbLFIMZQYDIfCBHhV2aBk4S8R0z8Tdoe4z4P9RbNnzItHQgYFaS8HsdYDyK5wsfO8GqBgty6UNKl7ugZnRzstjGsDM7iZ5JgfgXhatrPYJsV8FSr09lhrRt-pu9ozZCp_Lf8WK0FTJsQqad4hsZamVvUrKZkkKKDhlNiW-4OBjwNDZ8_G9ftvYH52s0u1M-U0CjngUyCAan0gvZVLieX6E1UoOVzcyg2zsjeBe3Ly4mKqwqNxu2OVpQBg5Ly4z5TEdCYHnLZlqzn60tXJ80vNiw59RAWLZep0T6i6BG8aoyNendn1UPlAUsTT9HQRUU_ME-D27-Sqd1zu7XsN9z4-rm0elC2u5U8jAmRgMvVf5eEOp1bLZ9DPGp2D-R5BrpVdpBWCuq52I-iDMsK_bKL-K-QDsvRuWZ5hYnzrbytsjf8CUYxgr7kzz1TqssG7_hncfc95rp441UP3V55s3D1BAA4rmhmb2ZOXCEbQVE7LmbJOyXPZCzkr8MhLLzcHnyTeWEz0-yDHqAQaj8InVfGsHc03oyM6c4gLVLlQ-BGLFlVHH8BpjlbRR1VfIvpipwcgCDMGjCRNEQ084cR2Qh5kZoNnnh3GvYPhakppbw-zeco6rh5AKMiFxS-g4pTW_2XAx6p1sA0rFH_7KtwLFUwk9MetCYD0G_oPKdHkldCqdaM4DBX4ISD6YgQaiLG4lOF-vPkhoFdJmFIDGgvpE_G1eJcIX8cUYCFKLi8o5LLyxl8M4kaOkjm78Jo5Rba43bAJGOKGSDpkcz2gjruUDWrMl8DVOS3eC0ahFVHDqvOyReOENDvkbSHjiMvuGh0wYCs79fwD0TiJ3dh00Bz-T3ydpciBWJWePvoc5E_DEvzPFcPCO5VVenbucsG7vUSFAMUE0BGbL6ea6yPByx0QLcroom8EUpSP-Yfe5KN2FZzdw5BcmocXBs-FTVX0Mg9xMh28gnSEn4OyN81UVdi4iAc_q86vTi1fdlKP0SNY1YWnTRENyrjeN_u2nDVHQVr7b3I05RGyotkp93YtLjI8zxwjGcuE_FZCFFiLtybsVCf2wi7_e4DEOG0hTAIMQrF5UHAnTc8fkLMq9bkSxOoAHv9NUpLDqPrZS2es2tSnGkzwQHuy17bSDZmRIFVnLSQUpJPrlfel_IjpTqPsPdE_3opdAsjI3goalYPQ9cgdr3VmkgBs8szzdmCthAOfISpIIIjptK2icevlI3vX_v44F2povjZAswhjx2aYaDwW6BH5EIkV6fdNG3R7QTMK7xU_CrkIusJ3odFNKbtVQduedUQxl223P_wXskFDrwsIrv-4kbvFI2oVx1xukWOSdX_GtuPFuS2vcQOiwaUTy3dkg73dr-wFXX9s8OQPkPfcyx5lgkc8m72GvMOWrvNu2_fggF1iSiIu7oc74kLhOJJMD00v5SlzM7fP04MhpbyVrIKoBhNij6tiksq6RWBE4H3IMGDkaPi2KlI331zwbquc2ibia63o9GvoFD9ardsETMo6f3Dw7xA5L00ZeOHzuYOAuLsxKNNnhthUhlVAVOcf_WBshrsnse2RijvKhtAC-gZNiIFsKl-GqtnRHtTGwV1RPTF9xLNtBZTf8TxUcpDZ2bwGsH2P9ivyCedPb9vVtZ0CY46nPoif0CXTUF5oBziGGqpJ6-DyfBnKrIK88bp9oXsw2hjlAZZwdHZSETcl2mO4wXbyWDY0mYPScY4mG-vk80i3RQM9qlp6AReRSxNVFw5fVSp3qIh6gSKgckrwQGGzhtFvC_auKKNbHKqh6GMRcnpAesvlXLVFzBi_gc__kpG7mt59Pn_DODu3N_69a--gsiJj1QroeZQCkO3F3I8p7TwIN1xHdTnlSTw1142O3Ky9yoLyXkEdUQFtV0ghPPgflSSUrJSNSTr8qFW8FviRJHBtDVqf1acULcEXljR0GlQF2fxeXDlASXz6ckFcaFggAEhLkaPAsAZYOHu_QOAheiTZTXoRgAQ&ias_dspID=3&ias_campId=25972359&ias_pubId=pub-8648432769746717&ias_chanId=1&ias_placementId=15826188919&bidurl=https://wallpaperaccess.com/&ias_dealId=
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.78.76.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-76-208.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b839345f67c944e5a832251a6abe16489672471a1cd4f796454bbf1902a86299

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
content-encoding: gzip
x-server-name: app10.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame C7C4 2 KB
1 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/window_focus_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:36:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:36:55 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C7C4 122 KB
37 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425f48a06ab0e9a4a4d792a6677189720f377ec09a073ecdae6232a89cc221f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1642595990432946"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 20 Jan 2022 20:41:11 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/ Frame C7C4 15 KB
6 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220118/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043cafc63f50b2ba976044bc7dfba6ccb1a1878d527f883cb81984c5585cd9da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:38:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6473
x-xss-protection: 0
server: cafe
etag: 5124071950003790117
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:38:41 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C7C4 0
0 70ms
70ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRdKrwUNVBghtSqYOf_r5S8SK2fxvim-CvtUnGgWirtWDETr6bFeoU-zsNQNZV0WUncKOWuTUeJfPTWYz02jg6fk9K5lQ
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3A25 624 B
297 B 17ms
17ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNO1pYgDEK-ju40DGNOWuL8BMAE&v=APEucNVm1jVB_ITrR1LKGz0_LN58ZKNXFosZG302-Dcp38PuRqDMFVJDio9-XEw_IFioN-ZB36B8o_mx9JbrSV7C_dIjs7_-3j5pzpGhUmUgLh9yOEvaXux-H-YePQLgLCN6Ri5DgoCtlj8YauBU-Enoz4gvaDo6wRShvYBB-liTzLw3ddoRM_Q

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 20 Jan 2022 20:41:11 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 55C0 52 KB
25 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D5isd5S64WAXQK4hyDVAONW33EMIhkk_5YEMXXqWPJ7vduNFIWqYwVqmr5s6l_zcABHz7tJkg47t1vyjpmSh2fnlYw7FW_b-KsVxGXSl3Gnbv2igrNxMLxKagY_p0hM_dozP70EdoQpsdqnOW8_Fos4nHZpA&dbm_d=AKAmf-BX3ozQYptey1Vc1VsWAPUwBuZGJsWckjfpo76yf2emVK1QIBzMsPlNuoOBKjjUgHhWkILSNAH5sODReM1RmNguEwSTzc7JMSBNi-Q4ceHva1P3e2wl38df5jm00jkmSZiOLgOeAqpZJjxepJyCG2kRDNuwY5ke37qXfsVbnQEgI0aD8Pe2ob65T5ihV8r1BPZjwZ1Qs8l8ZxFt-piVJnHi0i9loxNpjKzKPXeCSAEm9pv0-B9Hxv18AlaAHS5D7nHidzUm_L7RKHpoofrv7g9T7MF7ySh-AWDqSudc65mY2C7RE1dCtkJSi-Xjxoj8RmUUNiumZZmYruISk6kx8ov1GTIUg-iZ1Y4JLLQPixaMljzcG6zwKhRwIDe99d7L7lsXFroqivvMf7wrxvAIoZZyb6PXixa6GK8iTaEy8sUb4H2sgY-1gprXe240rsYfh6szkJ5UAsqzop2_ToDBraZyBtJ-X1QBJ9sEkTW-ypBSgzvEtABdIO5Z3svUT2C5GzXxFv-uKZAtwv8yf8_Jf4dmEX5Bhv20qr8NivO7esP46I_KXUJOAaQ2l6TUfGMfD-dc31-b2SL3k70x7r_h-DXoPaA0tX3oNEzTtuJGb_Q4siuKo4htOm3WQyuXv_COULczBF85i8RcN_rugMvlzxYOJGlMOinP703OW1saX1L7le5G1EXoEo9eju6zjCroTn2KVOEH9CTYCoaFvWktFFiMUIMsQvAcFt9lGv6Ox3P1-SIspaB963NyXtQWMoH9MnDXHfGh5dd0saEI7unhPtBHW4jaglkNQyllZFc4Ujq5Lxb1uI0X6nS5Ozxu8cTTDA104QTxI6Zvg_CHLcMHdBxQWPRXl5qjGtHpNOso0Iv-iv3WXGdetqoMyYEXY8NL7Yb7gOeqNBWdY687R7qD8BtpbcITp_XclPqn9B-lac-ha7-CoulPPVf0rfwNWI5iC8-a1J1qD_zusdTr-fFJbvPOwxHPS3BPuusdUB0FmBAUp4xKKkUc_20-UdOwpa5uIBKDqNVbPb9jmzn_V22adZGz3Nub0x6ZQ2zQBSFumpu7vF7yK68zW8XV_aebU2Vvv6-f_ZpSwW-d5g7B4hevxUixyw29-1tV35bfg_2Vq_oc4L_IcJN9CIurLS0fUnGfNqSkMjJ2j4aVsTUxoD79yzuif_Yl_nv8tugVPZrC0obAxcNvhr6seZep4xUIdksuc0EzbnBYN96GDPmQnji9yRqocvcet4S-nIEa_SGkNsp_jkj4rmUkDl1Qcfmg1IY_5tf7hcb-Vh3_JcqLd6DUfUpXgD5Y6r7P8gxndgyDVX0r7QFcOX7wKyET4t1Z055hY646MPLIrnUz6WiGuBVSGY0QO4xqFmqQo0j5mlS1NqX2nGznZjr19AdPDxWXWLFIwn9O_Etop9_g8AWN5fYEG12Uibn05cugB27LDG0lezRBNaamwp2RKfrNtpybjR0aP0nJA1seKHNaQ1-l6wwyGKcdmOi6a_fXlllY_XWfvkiv-YUUkQ3mLxkyOkvBG2zXHw03yGvuYHNGNrfreXZ3805_Q2i2Iv7macF2NgKO9W8FipujSTN8vzVvlBebOwnmU_t1Xu3xUJb5joTGpCBdu-0yo8yRgujaGp9nszyeM4YE1DAuHO5MLh0gNyidbrGaGtxHYrWw0RJam1L8PeCHmiAsns7Hb1w09Xv95qvh2pnJH9zs_DheovFpypYIJ9cfiV_JsxTY4FfwGfTezF1k40xD8e1VevpLCf2dWOwNbqu-AcVKnXIA4TLHbBzV1AOr5DEhMVqd80luN1hxhp3WuqZWR1UyBOZVXPkywKipn8pFQZcpcRGts19CplZMivrld4Dkg0zlp8BfwtCYfMeTrFZzXB1qOWYDJB7MOKSpaPqASAQluWW1CM7-yNO0b3Q2yIcMI3ifIvfyOUCrbmGjsolMmekT2SggGjKY-FLaFXVgWa7U7IIxjeJxOyFTRQnuYELX9kaLpAP3i4hcFShJgg3PK3IwBmtU1RlLXc6t516JXr0MWkETh2oN6F1HQLZ_JtdiUZWqhXDhxXWaGmZvJlO9lDONgZQ8pbhkLIf0MuYzAJcZZ4t2oyL6vHGWwkUCcdJH3HXyTCJ9B2LlfVMMn7Vz0mE7_dGC7Uharxi3MxoqP4zs1gL93mpPZo8z1-JxY6B0a77VwHjFYJltuxd88Tn6Nt9bQuB44EO2xJ5WZWBfp58keeNcePnUbzUDVDDY9vnD_uI6KLFzaJycp3dWvB4mYUodc9z_x1LAseOIpT_OEBHGbEXsvTikPmchSI--O-_SQc2xnzt1f_1EMxmUrbUQ8D7k8xK2N4J-ZLcIoAPrc2ERSeYC8Q6nrEkdLclW-fiA4Xl9muU_SfzZomx9ZfaC7TuCFWkm9JLdk1DTlKXgUokJgsYTWPmh9yt24f8iNYpwqhw2VjXuyo2VO5rIoDDutNFVAYdCp3IJMIjUHiSmORlT7J15NGFppfHQes0g6p79fgj-UUshFG9l8Hldc47-upODwUUoVMQw3l2Ok1R7F640kFYlD3tlMjPsUrZTJqvBBQukxL4al4QaY785Gsf0ZxXI2lMMEeNlhaNqc8ZF9uX9DLp1VSvfubBtFYGYWhrQgVpi1jflBNklkqnuaMuVdCudX3FHb0-B_boz72uEZqo4zHOlrE7XlxuF4Sx3L9FbWFzZfa02_JhEQyd3GstICTHs2Oktcar3Gib2NLXInZObCq_32VuZGt61RaaEGxRiPbZn0GwSCvDOEBmr8FmiFkvSNzGtkz98yCXGqA6Z2pB7T_YZUZEDJz-4jiJxV9iEqO_8MdoqbNEV7BvGV1LuRAbcvgxXZxscb206ZvXQ4qleprfpsQ1bEcKu1v6TFMVvsT0qQWKZcuvyqas3rQVj7sLDXSaK5lRE_MPKYyrxg8g01YCCvDbv35tPehSnbP-zLk8aiRIXcxjrClVTKja3SKSHnXmgQDMVZlG6lSKPNOGMWo0&cid=CAASEuRoV-4-2ZmTFjBwsz8Kea8yDA&rfl=1%2Chttps%253A%252F%252Fwallpaperaccess.com%252F%240

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f4a9ba5c2c89dd2d737edfc10b22294689405cf5b85fc9f0fb0c177700b1bbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25223
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 46ms
45ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022011002&jk=3477402087512202&bg=!T0ylTAjNAAZ_DxPPfw87ACkAdvg8WvY3B8Jj0oXkSMtnGkToGnIXMsZioxizkGvCOjxUBv1qL_wD9wIAAAJzUgAAAAJoAQeZAsueOUxDNCoq_9V-uX1k-rZ7i91yUd6v7s_dS9Oe4tBMqG4JFlZya640VJwsSE3gS7RZC9fkwt0nNX5zivfVdip7OVGApo2oD9xDlCy1rYHU_EO_brgh66QZ8cNwGGiyYr3wJvgFfUbqzu4Crewv_MNk6yAEGZwB3az6tGH017rd8bt3rXr3LLY-XYxpURSv6HD20iEsvoc6aFLNQ006l2jtPL8tivkUM5Sd_QJMyKybLtZzpzOrgAeGdzBvBPjdJMlNcZry5cmQxi_2SK3yBoCXUCeyi76EGchC3xeeLIkjNsU-kB_DdBP4Jt4XbAJVBAMAtBobfD1Vbh3cgkq2Z74KiHz6L6gSdb-l3Zj-HxzgW10BppGULbizbqQA_WCMp8cXkEmS94o7H9dSpCoMBG9AauSeYrKDaSnJP82MfbBFQzoJ2rs0MKe3lioRRXArZW_YoKAimfGsY_ysyP24JSKem-D5IQSvKzruXDlSJqI07msK0ld5CucsdQrjuFgDYiG6kt3ffJ2oG2t4UO58jDGqV44_cMnLcLJ8Yv9wwB1vpDlDmVDYH9HWTBMEfRZewDTL0hRfhkDGULhy7-YVo2PZnHjHYcHqOLMIJOJfjGAkvGX9ZH_lfmTWn35c55SKYbmDJVRCTuf-HKFBSYql6i6QX83Wd2Tb3ohNDDjd19OH9UTayO1QCBYn4PsStt6Ws1HfqoDM9tqZ28FyFQWUNi_-abOMFk9GUe63Ab7zqT4eNiu8zh7sbKvV91dL3thymSqVOzOrsr6Z8gtdzFZcDo8gG_V692CJJxvnNVJ7kjpLPEcIuh1a_S6xmK8icTR8mgKpXvubt7KB9Z-c3rwjt-sg9QuFKsnw7wWu7vDv7v5usnJwPS_uP3G7YQntLC06vuvUYgpUUdpX-wffYJQ5BvdNZ3JjG469tXTXZsa5iblz5YyyuQHyAm2u4iAe

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F02B 640 B
316 B 77ms
77ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiL3ZC_ATAB&v=APEucNXjKYbAxzntEfQSSulizNFuFnLVDHav-QUE0n-U98vcTirWO26lX_gGqsYUPvzet7oMZZ1vl6jaJb5f4TJqxryZf0Di8EAjlDA3sEmJ6gl1sZkvvz4TsYXoiJbA2kbMrMeq92bTmBWvbNU9nLnOgQYGmJxumCYidPkQJH82r4dw5ECv008

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 20 Jan 2022 20:41:11 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C7C4 12 KB
9 KB 89ms
89ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CSojgAsdwa555WGYP1_jWYK-dmL0nohpQI0_4wlizkS_PtIJoOkUXwM4g9o2N1CI4d0fJR5V1Hp4Vh1lTh0F6bSK2xo8I2Fg_xN3kf04iL_iXnZf-3U63bxfedDyNrdU1sqvxobP4_XY1ZSIJJIt-YCcD2CQ&dbm_d=AKAmf-A61oRkZnlnTtKSQ9S3tMylxZywwjUyvl8B5CagESF7xGS1x3xZ7oFlpouLEQMefzCZlJzIDq6X0aLP3JLv2RJNSgFQdTU1KGf2TRhJDZBhrFK8B9JY5przafXLYjBaE4xU-PE0bYSKAmRIxz2BiQa79ZeF5R8V-bAEc1QUC1pHH8K3X0LQ1vKLo5o_trzM0DoC_l1pp3ySDcBJXxQH23SH3Ckahy9DCyX_tF-aNIU-7uK7XL18ADTa8-exyXH-77MU9pi9mNs0rkoGndSqIv6BcrdJutWXjtLgEkdw1fM3-0pRHhWgMA8cpbcKokENVvgSRpCEI_8Nf_CDVYjObQc134TznWU2WQX5xYHfMPRPeUaRpawmG19Pqn0_mMAn_pYW-cPSaYj4oDpx3ynQPDHeHjZAPix6Au1HPvgDEYGaXM2C6GzVYNB8y8T2nQZnLeNr9svILs7PvsRlocpP8PXrA6mpuEC_yLGy_zYNCkRvMlFU95bFMlqXS29f6SVZmXQ598sylp6BNKDk8BuGmIkcmo-FdIsCPanjPpKBSWeXBc20QgZ3cOa1MI1ol5GD7PoDYCDswtEUB0FXgFXMt4pyhqbuAtPZj13xiT7jaPzwXQuudcuE2X-HzYzbns5exNiM_minW_hLGQq-tOpuQmYFwF4Kgwp_BmMEbIsL2LFX445fnFR6gXnwMwb2RCE6zWNLQtXs4nB_Yw7AigJihE5Z5BiFhmnMJl-ZPQUW16CWeqVlAxls7-IyoElLeKQczbywLvD0p6gQLzQDOBAHywO8vqapAYbt64imBwB9Y_k9ifBWs6JbzDXVJBSQ3f8UNWv-5QiBEdPq4l-PIShcDasBYHb0mAqm5rM0qV7s8jpYBMeYGftlVv34gcnL1EP1GwARrijlgSa5ZmRsCP289PfC7DzWfsyvNYeIOoeTNt9f7YsKDccuXtkcBxrWzDh8jcIIQo_ePouT2i2QChT9xxrP37uTVZbUM3oMQQ9HEN7t1ASE6aK0Bzuu9VXgxTLM9dy42IAkd0ofiScWk-zKkSx-nOua1yQ10ARzzPnrptKH-ejOTGknsKeZtrkyg1ZB9U4Z1qc9d2LRznynPtt7hnPqQzw-rGTUK8EFxcfHce8nj7VrQWkVLPgPgmR5ICGiX7SCh_pvnFst7-BRyraToh6dfa04fvkNzeUu6HfxMjriWK8G8d6_fz3modB6mD3XDW7gX2Wc89mm8C1LBNa5W7Av0Sg3ml81oDcGFS4aTZ9biQt20JmYtHixo9ITblK1-Jo8RFT-ReVKpFMWbsXSW4NupOSmw9c2-SdazmzuZKKqzz404lnf1HWHWK1tsrEnbZboexorFa18ie5yk_2m-bHX3lIrS3equx3o9BgUD_7xiO8HqhBsJOJ-NJE0HH0UNcYCCGiTroH7AR4ykyyXSPoODzQXwecu7umEshmK4npKhLKi0iNX9JjmVGcgn4VFueoFG-WYa-Xx2PozamYOdKRRV280F2XGMEPQ5wE4sIw_wGIW8z9dStOkz6aM3uu1Scs9PIUvavKUGf8MiQPX0x09mf39f-Az91qtvvPuiLGSX1APILi8jymWq708dwGAlZhU7R6HdgL2PyphiWpm2_4wWijsEwXabZS2UUM69PVmaaVrIZcxHKNrlITypuRvGC9IBTfOkq439DBrYY94dO_IeWP7OI9BvdVBbBKymBc-SoZ_9V8AznG4EdRATo25v3nOfWArhs1661ihGSFxzLQefQaeKiNWV3wCioDFn8DsowMl-LXsZhPO7Bs66KuNgdij7sMHZ-1567qJkz1_9bSdXhBv61GUrFXpR9QjtlTPtVi6QOXZDmij7Lh7MMQeLrV3oGVZwi-kn0GEjeZvAHJo2_al5GR1ntPnKwYp9nvxhwB5LpEFo_AxCyfS36SGUoX0Q1vEDo85Q7lDmH-sFVimjGgd0u7QRLcGDKOaS0FZH3IsJ8GN8E256fTYHJ-ztS18Cef3YbpmlgZSKFSwKlW-iwIHtV4RJuC44QC_zFqa6VnleXMnll1WEps3wm3dyqt4uzIc14oJ2YYQfTgcmtq9arltPe1zgVCsmp8j2BNQkn4HhFDbdcrJJMcyk2EJvFOvM8wV7TQA2x6DpgVsg5SiqXP-V0CyU4BMvrKb8_PIVhrQ2hErTixb_s_Hf3kESs79B4i8Y4KuoMRPykfxH-TmzbAkesj956EYeaWKQBV7FymoGoblbJXO6yNFrQ2Xs9kjp28uIPlK0o4CqD0hfkJTeYLaOZLjm2oYIgs0LcUQt5SMiJYtsR1WmjRYGHFXthfV__uLm69_jzPcu-ksMEJOVg5N9uDC5whmu9DJ6oLg5NvXDkfMmMhl7iBLjBAmUEaupSKpI_avpURdxLz35n_Lw7B0jNxFvme02CpHykDPRybrFHlVzP05x2UGg-4wrS_0QxU_Y_z2bE1CZH-FeX8ASuwwoQAbDR8oY179MoEiHnXauZiPIyTeLl5IL_8UrG877JZwk_KsZ7N7SItzEWsyhTyOBOyPwUuELN5ABtNh5laM8Sx3X1zMYYz4ZI9R6NP5BXtz3V8HXn3zaVmXChx_g3RyyqV3a3MhwkGE-JbNEjN3bnyZNjtm1YbLSJFBIgl7DQOjUEybt8YZULJNjNuzRIa3ovb_Nq0E64eWZmBM0Ib6N3Tnm9UienTSaCMK6bFTmSs0&cid=CAASEuRo8CwBlg4e79A4CF6JNlNehA&rfl=1%2Chttps%253A%252F%252Fwallpaperaccess.com%252F%240

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abf94cc000d60d8b3eea87e75f85b7e5b5f6e021c7d806e416fc3154f791f613

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9321
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 35E6 0
0 65ms
64ms Fetch
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cp0j25sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE-gFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg8CR_1PTbEgEh3KKXdJ-Q1oTBla0v5l1vdjpURIiBKxmVHPSkMTV4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzOACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItODY0ODQzMjc2OTc0NjcxNxiTwnA&sigh=ynluaCSW2qY&uach_m=[UACH]&cid=CAQSPACNIrLM0JZC3Nw9REOdiqQj_nRx5PEnOb-rXxc45w-UsFuicn19dVwy6sQcq9El09G2eO1uLRCUp6nAbRgB
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame 35E6 0
0 77ms
20ms Fetch
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1h67775wcwq9s6fpk30s3shfx8r197mg68pw81q2g21990j5dqgq992ts9e7pjddx33cehnzdem988gytxjffcxyee87jsw3tgjgdsj08a3ntdbb4xhx6ybaw42n3r71rmhzhf718fwangp4s7as5ggf783zq9a6p7s2y0ga9kfe6dhcfb5xvctx78ye9z454qv50q5wy88r9f8q240m15m2nehdb9qbwdp5cyzv0bccx2vb6425gsrqt2yzyb3x9mtqm21kg1dzs89kwys6p09m2drbdv7mzx5z0t6c9t9gbmevxg2a1zpbk4fdffd12cwz2f4e7fjz44jb857m9m08cgdz4fw4t8aw330xv9e36zzh9j4f9rz7ttstwsdwdwar7wt21xddr7qg086vhrczr0w3c&b=YenI5gAEwAUK4DGaAAsUlbZ9rvQYa4WWtDDVcg
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 20 Jan 2022 20:41:11 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: image/gif

GET
H2 200 dr Show response
as.ad4m.at/ad/ Frame 8449 2 KB
3 KB 142ms
64ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/dr?ed=1kzkr67gg6bfa6h196c9wjv4msv9wyff3zndhq5zrnjwfkc2829de0cm5mtzfhdxmn2vd26011mgeeqqbrdek09wtn5k6caf69bqtsaane9ekxb6t8nv7vrwtna4cxvda56mxfyrs8x4wst6pngr25b58qyasa5wttwjc5krxh9d16kjgpapk5cen9qrmzbqt9jyq4t4erkkkdm2n65ggrp32rtqbeapna8ngc3scyhg3dj6z5hzmkagmbsfjzzrwr1d896d13k8r3gh3fvgwcgj3mmq4yh3ck1qzhwwt7wjggrm61741s9647dxsv5t08ndt1b535t4xn215ekgr3r3ta3a2n9ttan25d31wxaet0a2qam3skkgd4aswnpnbxm7kj4qgh4f1zxfmrsah9rcrtcxv18z1e2t4q5ht6svx94kcddg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%26client%3Dca-pub-8648432769746717%26adurl%3D

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66c6d54667297fcd35c73c5be38518c43f418c6c0bae86da125d59a9d03beeb6

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=86400; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options: noopen
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection: 1; mode=block
cross-origin-embedder-policy: unsafe-none
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy: same-origin
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires: 0
surrogate-control: no-store
pragma: no-cache
cross-origin-opener-policy: unsafe-none
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6d0b1f480e685a25-MXP
content-encoding: br

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F886 1 KB
749 B 34ms
34ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 20 Jan 2022 13:26:12 GMT
expires: Fri, 21 Jan 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 26099
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 35E6 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d13dae1cbef91203d9f2c23cc9a8a2e5496ec8f000f9108b7114b8d0c0d872af

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3A25
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPAnH44r6jHFKTjHMeBqxdU&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPAnH44r6jHFKTjHMeBqxdU&google_cver=1&C=1

43 B
1014 B

43ms
43ms

Image
image/gif

92.122.254.129
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPAnH44r6jHFKTjHMeBqxdU&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNO1pYgDEK-ju40DGNOWuL8BMAE&v=APEucNVm1jVB_ITrR1LKGz0_LN58ZKNXFosZG302-Dcp38PuRqDMFVJDio9-XEw_IFioN-ZB36B8o_mx9JbrSV7C_dIjs7_-3j5pzpGhUmUgLh9yOEvaXux-H-YePQLgLCN6Ri5DgoCtlj8YauBU-Enoz4gvaDo6wRShvYBB-liTzLw3ddoRM_Q
Protocol: HTTP/1.1
Server: 92.122.254.129 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-254-129.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:11 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 20 Jan 2022 20:41:11 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPAnH44r6jHFKTjHMeBqxdU&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Thu, 20 Jan 2022 20:41:11 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3A25
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YenI5-Ld1B82xGffLVzS-gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPAnH44r6jHFKTjHMeBqxdU&google_cver=1

43 B
894 B

55ms
55ms

Image
image/gif

92.122.254.129
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPAnH44r6jHFKTjHMeBqxdU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNO1pYgDEK-ju40DGNOWuL8BMAE&v=APEucNVm1jVB_ITrR1LKGz0_LN58ZKNXFosZG302-Dcp38PuRqDMFVJDio9-XEw_IFioN-ZB36B8o_mx9JbrSV7C_dIjs7_-3j5pzpGhUmUgLh9yOEvaXux-H-YePQLgLCN6Ri5DgoCtlj8YauBU-Enoz4gvaDo6wRShvYBB-liTzLw3ddoRM_Q
Protocol: HTTP/1.1
Server: 92.122.254.129 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-254-129.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:11 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 20 Jan 2022 20:41:11 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPAnH44r6jHFKTjHMeBqxdU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3A25
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBo-hC1c1FzCPAVCzv3_jGw&google_cver=1

43 B
1002 B

37ms
34ms

Image
image/gif

185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBo-hC1c1FzCPAVCzv3_jGw&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNO1pYgDEK-ju40DGNOWuL8BMAE&v=APEucNVm1jVB_ITrR1LKGz0_LN58ZKNXFosZG302-Dcp38PuRqDMFVJDio9-XEw_IFioN-ZB36B8o_mx9JbrSV7C_dIjs7_-3j5pzpGhUmUgLh9yOEvaXux-H-YePQLgLCN6Ri5DgoCtlj8YauBU-Enoz4gvaDo6wRShvYBB-liTzLw3ddoRM_Q

Protocol

HTTP/1.1

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:11 GMT
X-Proxy-Origin: 217.64.151.6; 217.64.151.6; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: c6fa22d6-9d4f-46c6-b1e3-595f80d51262
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBo-hC1c1FzCPAVCzv3_jGw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3A25
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcwNDg3NTczMTc3NTk1NzkyOA%3D%3D

170 B
188 B

52ms
52ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcwNDg3NTczMTc3NTk1NzkyOA%3D%3D

Requested by

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:11 GMT
X-Proxy-Origin: 217.64.151.6; 217.64.151.6; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 0c3a3296-0162-4589-8add-b39b0d69cccb
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcwNDg3NTczMTc3NTk1NzkyOA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220118/r20110914/ Frame 55C0 24 KB
9 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220118/r20110914/abg_lite.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7c55617f84818daf4c70cc10ada26ddd5b582b1d1c2c2829b3220487a6db477

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:40:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
server: cafe
etag: 6261108306223674270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:40:34 GMT

GET
H3 200 5733161425256762556
s0.2mdn.net/simgad/ Frame 55C0 11 KB
11 KB 38ms
17ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/5733161425256762556?sqp=-oaymwENCMACEDIgAUhkUAFYAQ&rs=AOga4qkR5Q9KXoTE4MUlokgN7-HMb0BjgA

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98bb2b4784b1aedbaecf5e48b54789421d98e940f1c6a34d8f2790222e082453

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 01:54:20 GMT
x-content-type-options: nosniff
age: 67611
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10837
x-xss-protection: 0
last-modified: Tue, 11 Jan 2022 10:00:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 20 Jan 2023 01:54:20 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220118/r20110914/elements/html/ Frame 55C0 8 KB
3 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220118/r20110914/elements/html/omrhp.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Feb 2022 20:32:59 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 55C0 0
24 B 82ms
59ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssFVEADk4fUxvjMo1vgirVc6jRlABC7Q0XAP_I-Flhfxqs_Cgfr6z8lgWa1xYRxANNay8fKf7bl1bBlGJ6NZt7FMk2fw53bn0YPybmcYWCQaAgsKIQomUJ30f8KwcouBlSLefAgB2reQIQo8vkZ3mjHLBUueP7YcUouv36vFGAZKML2cxiCF8r9EoNuWhBgjOtWEvFS417rvyQSar5G3KnP0p9hgKP027kcA90HvkF080B9CtJPUpHLvfTQhU2uAxxwGLDTtgIWEEerjXbFeC1ODO1fWQNiPxshE6qATMaBqa9ZzqC9Dp2Fmbg8SJMqZL3dT9-Ag8xWBGP7B8VmLiVjdZzO01vNroOPfuNuA-tBN_PVTT3b0K_vyQxxpPnygxG-LuUxZYkqNeb4M7_EEv1GcL7vHcW-X3BIOLgsiOOvW4Jw-yUqtoa1StZ2jJXGML0j-DLdTx6C8NQ5Nsj9fHF0TMGrsWK2k_UADeAMapNP_Ir7GOUt_YOeu8-_ghQHwhH2YAoz1iML_YYJnLRdEP7m2yyTyVNaPX8EFW_KkIfFDOzzaoGWyKtZabPiPCtMPA6On-hN5gGd-QY66FcNfy_Pn0a60d8FSmrypYvHrxC9-OTZq2AMM67Qj76Bym2A1UmkF48Hbl5neB1i-HUsLB7tWvOlZDraQ-9TfzH8ncNlZUZh0BsSAHNTUMBEnKV9vMkZ0BdDfmZtSLk3wXaAFdjC8BpDTaGJNeULAzLZzZN5PS5m7GJ2NL6bWyUBgvNPG0c674Hs4rQD4P8_HULrrJupyscNWdFkg6P2unVepSZR9_0GISujokQyP4yk7qu5nD_oHlWQvJaBdZq1u1YvwrXxQAbAI8HfYKOIJq3ykqgh3S-ahOmlt4nvBsbAds_D5_3IOU5d3CkpPHD5dSUgmwKxmgeUKpuS7SDcKGK0x8VjFscKCFC8jFQXGkn5-EAn3403xcow_yhgxd-9vjozehboaI_THoXgmyG89nBGHX4lcvc2P6KlzftT6bKxcfF9KqjmCcFMzjRx9mT-F2rDmpkZaHyyF6zehsfVL-LmD2o20YQrxa7Z9dEQluyrKABHawg4SADkYTx9kZrFYEfBylPaNM923XplkgMcC1hUvHZ_dVc1iIpjQSaPdhQMJ5hmMjOKRnDJTQbXu4MVZ0K7Qp0Ad4IBG_AYyK_F&sai=AMfl-YTIcDAczB4vjVnJ9Be-wZDPJW2WRyUYvI8V4jk0k2ohFHsUvZLkNQPmM9A7dEwR_a1wVNCC4dpVOFA1M1V5gZaWqsnmH-XIPDq06K5YowxdHqxYViqq6X2QBIvDtl8Jf_3BooqRcAZykYcVtqVCUoCrjcEQBA&sig=Cg0ArKJSzM25MOEPqYvUEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220118.64329&adurl=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D5isd5S64WAXQK4hyDVAONW33EMIhkk_5YEMXXqWPJ7vduNFIWqYwVqmr5s6l_zcABHz7tJkg47t1vyjpmSh2fnlYw7FW_b-KsVxGXSl3Gnbv2igrNxMLxKagY_p0hM_dozP70EdoQpsdqnOW8_Fos4nHZpA&dbm_d=AKAmf-BX3ozQYptey1Vc1VsWAPUwBuZGJsWckjfpo76yf2emVK1QIBzMsPlNuoOBKjjUgHhWkILSNAH5sODReM1RmNguEwSTzc7JMSBNi-Q4ceHva1P3e2wl38df5jm00jkmSZiOLgOeAqpZJjxepJyCG2kRDNuwY5ke37qXfsVbnQEgI0aD8Pe2ob65T5ihV8r1BPZjwZ1Qs8l8ZxFt-piVJnHi0i9loxNpjKzKPXeCSAEm9pv0-B9Hxv18AlaAHS5D7nHidzUm_L7RKHpoofrv7g9T7MF7ySh-AWDqSudc65mY2C7RE1dCtkJSi-Xjxoj8RmUUNiumZZmYruISk6kx8ov1GTIUg-iZ1Y4JLLQPixaMljzcG6zwKhRwIDe99d7L7lsXFroqivvMf7wrxvAIoZZyb6PXixa6GK8iTaEy8sUb4H2sgY-1gprXe240rsYfh6szkJ5UAsqzop2_ToDBraZyBtJ-X1QBJ9sEkTW-ypBSgzvEtABdIO5Z3svUT2C5GzXxFv-uKZAtwv8yf8_Jf4dmEX5Bhv20qr8NivO7esP46I_KXUJOAaQ2l6TUfGMfD-dc31-b2SL3k70x7r_h-DXoPaA0tX3oNEzTtuJGb_Q4siuKo4htOm3WQyuXv_COULczBF85i8RcN_rugMvlzxYOJGlMOinP703OW1saX1L7le5G1EXoEo9eju6zjCroTn2KVOEH9CTYCoaFvWktFFiMUIMsQvAcFt9lGv6Ox3P1-SIspaB963NyXtQWMoH9MnDXHfGh5dd0saEI7unhPtBHW4jaglkNQyllZFc4Ujq5Lxb1uI0X6nS5Ozxu8cTTDA104QTxI6Zvg_CHLcMHdBxQWPRXl5qjGtHpNOso0Iv-iv3WXGdetqoMyYEXY8NL7Yb7gOeqNBWdY687R7qD8BtpbcITp_XclPqn9B-lac-ha7-CoulPPVf0rfwNWI5iC8-a1J1qD_zusdTr-fFJbvPOwxHPS3BPuusdUB0FmBAUp4xKKkUc_20-UdOwpa5uIBKDqNVbPb9jmzn_V22adZGz3Nub0x6ZQ2zQBSFumpu7vF7yK68zW8XV_aebU2Vvv6-f_ZpSwW-d5g7B4hevxUixyw29-1tV35bfg_2Vq_oc4L_IcJN9CIurLS0fUnGfNqSkMjJ2j4aVsTUxoD79yzuif_Yl_nv8tugVPZrC0obAxcNvhr6seZep4xUIdksuc0EzbnBYN96GDPmQnji9yRqocvcet4S-nIEa_SGkNsp_jkj4rmUkDl1Qcfmg1IY_5tf7hcb-Vh3_JcqLd6DUfUpXgD5Y6r7P8gxndgyDVX0r7QFcOX7wKyET4t1Z055hY646MPLIrnUz6WiGuBVSGY0QO4xqFmqQo0j5mlS1NqX2nGznZjr19AdPDxWXWLFIwn9O_Etop9_g8AWN5fYEG12Uibn05cugB27LDG0lezRBNaamwp2RKfrNtpybjR0aP0nJA1seKHNaQ1-l6wwyGKcdmOi6a_fXlllY_XWfvkiv-YUUkQ3mLxkyOkvBG2zXHw03yGvuYHNGNrfreXZ3805_Q2i2Iv7macF2NgKO9W8FipujSTN8vzVvlBebOwnmU_t1Xu3xUJb5joTGpCBdu-0yo8yRgujaGp9nszyeM4YE1DAuHO5MLh0gNyidbrGaGtxHYrWw0RJam1L8PeCHmiAsns7Hb1w09Xv95qvh2pnJH9zs_DheovFpypYIJ9cfiV_JsxTY4FfwGfTezF1k40xD8e1VevpLCf2dWOwNbqu-AcVKnXIA4TLHbBzV1AOr5DEhMVqd80luN1hxhp3WuqZWR1UyBOZVXPkywKipn8pFQZcpcRGts19CplZMivrld4Dkg0zlp8BfwtCYfMeTrFZzXB1qOWYDJB7MOKSpaPqASAQluWW1CM7-yNO0b3Q2yIcMI3ifIvfyOUCrbmGjsolMmekT2SggGjKY-FLaFXVgWa7U7IIxjeJxOyFTRQnuYELX9kaLpAP3i4hcFShJgg3PK3IwBmtU1RlLXc6t516JXr0MWkETh2oN6F1HQLZ_JtdiUZWqhXDhxXWaGmZvJlO9lDONgZQ8pbhkLIf0MuYzAJcZZ4t2oyL6vHGWwkUCcdJH3HXyTCJ9B2LlfVMMn7Vz0mE7_dGC7Uharxi3MxoqP4zs1gL93mpPZo8z1-JxY6B0a77VwHjFYJltuxd88Tn6Nt9bQuB44EO2xJ5WZWBfp58keeNcePnUbzUDVDDY9vnD_uI6KLFzaJycp3dWvB4mYUodc9z_x1LAseOIpT_OEBHGbEXsvTikPmchSI--O-_SQc2xnzt1f_1EMxmUrbUQ8D7k8xK2N4J-ZLcIoAPrc2ERSeYC8Q6nrEkdLclW-fiA4Xl9muU_SfzZomx9ZfaC7TuCFWkm9JLdk1DTlKXgUokJgsYTWPmh9yt24f8iNYpwqhw2VjXuyo2VO5rIoDDutNFVAYdCp3IJMIjUHiSmORlT7J15NGFppfHQes0g6p79fgj-UUshFG9l8Hldc47-upODwUUoVMQw3l2Ok1R7F640kFYlD3tlMjPsUrZTJqvBBQukxL4al4QaY785Gsf0ZxXI2lMMEeNlhaNqc8ZF9uX9DLp1VSvfubBtFYGYWhrQgVpi1jflBNklkqnuaMuVdCudX3FHb0-B_boz72uEZqo4zHOlrE7XlxuF4Sx3L9FbWFzZfa02_JhEQyd3GstICTHs2Oktcar3Gib2NLXInZObCq_32VuZGt61RaaEGxRiPbZn0GwSCvDOEBmr8FmiFkvSNzGtkz98yCXGqA6Z2pB7T_YZUZEDJz-4jiJxV9iEqO_8MdoqbNEV7BvGV1LuRAbcvgxXZxscb206ZvXQ4qleprfpsQ1bEcKu1v6TFMVvsT0qQWKZcuvyqas3rQVj7sLDXSaK5lRE_MPKYyrxg8g01YCCvDbv35tPehSnbP-zLk8aiRIXcxjrClVTKja3SKSHnXmgQDMVZlG6lSKPNOGMWo0&cid=CAASEuRoV-4-2ZmTFjBwsz8Kea8yDA&rfl=1%2Chttps%253A%252F%252Fwallpaperaccess.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 20 Jan 2022 20:41:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 55C0 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 08:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129189
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Jan 2023 08:48:02 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame F02B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEcQO8OHXYpPmDNWkkk1F0g&google_cver=1

43 B
61 B

62ms
38ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEcQO8OHXYpPmDNWkkk1F0g&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiL3ZC_ATAB&v=APEucNXjKYbAxzntEfQSSulizNFuFnLVDHav-QUE0n-U98vcTirWO26lX_gGqsYUPvzet7oMZZ1vl6jaJb5f4TJqxryZf0Di8EAjlDA3sEmJ6gl1sZkvvz4TsYXoiJbA2kbMrMeq92bTmBWvbNU9nLnOgQYGmJxumCYidPkQJH82r4dw5ECv008
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEcQO8OHXYpPmDNWkkk1F0g&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame F02B 43 B
305 B 71ms
27ms Image
image/gif 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiL3ZC_ATAB&v=APEucNXjKYbAxzntEfQSSulizNFuFnLVDHav-QUE0n-U98vcTirWO26lX_gGqsYUPvzet7oMZZ1vl6jaJb5f4TJqxryZf0Di8EAjlDA3sEmJ6gl1sZkvvz4TsYXoiJbA2kbMrMeq92bTmBWvbNU9nLnOgQYGmJxumCYidPkQJH82r4dw5ECv008
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame F02B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESELCNMLMy0cmdsUe0HIPV3SI&google_cver=1

23 B
172 B

158ms
86ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESELCNMLMy0cmdsUe0HIPV3SI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiL3ZC_ATAB&v=APEucNXjKYbAxzntEfQSSulizNFuFnLVDHav-QUE0n-U98vcTirWO26lX_gGqsYUPvzet7oMZZ1vl6jaJb5f4TJqxryZf0Di8EAjlDA3sEmJ6gl1sZkvvz4TsYXoiJbA2kbMrMeq92bTmBWvbNU9nLnOgQYGmJxumCYidPkQJH82r4dw5ECv008
Protocol: H2
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 20 Jan 2022 20:41:11 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESELCNMLMy0cmdsUe0HIPV3SI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame F02B 23 B
172 B 200ms
71ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiL3ZC_ATAB&v=APEucNXjKYbAxzntEfQSSulizNFuFnLVDHav-QUE0n-U98vcTirWO26lX_gGqsYUPvzet7oMZZ1vl6jaJb5f4TJqxryZf0Di8EAjlDA3sEmJ6gl1sZkvvz4TsYXoiJbA2kbMrMeq92bTmBWvbNU9nLnOgQYGmJxumCYidPkQJH82r4dw5ECv008
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 20 Jan 2022 20:41:11 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C7C4 41 KB
15 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 08:48:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129189
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Jan 2023 08:48:02 GMT

GET
H2

200

passback_160x600.js Show response
static.adsafeprotected.com/ Frame C7C4
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/906442/60231624/xbbe/creative/adj?p=APEucNV-xLlqC9OGnCOOmSz9HkDiTGez7DWQCKux7c3WB6C6lEfKk5o&d=CnkAoCZ_4G9vGb7_Uw5LAsrazxLygf_t-oYCB8QpgBmIVmqKKvL-hTNl1LSUfGCb...
https://static.adsafeprotected.com/passback_160x600.js

3 KB
2 KB

49ms
31ms

Script
application/javascript

2600:9000:214f:5a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_160x600.js
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2600:9000:214f:5a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 95e9b520e4fa4708a1c77240f74659b7964412a25f37c656cb1cb05cfed6b324

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: XJ._yqLKiJ.ggZiojna4n5bFF9u.OUZu
content-encoding: gzip
etag: W/"e27cc778cdbd4fb2ab2c39d090d5c119"
age: 1905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 21 Jul 2021 22:11:39 GMT
server: AmazonS3
date: Thu, 20 Jan 2022 20:09:27 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: 4UAy5ex32uNR6emQJa_iCKqto-hV1LXZmSXyQ8fSqqAGTQq0rKhKSQ==

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
x-server-name: app11.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/passback_160x600.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 821E 80 KB
21 KB 89ms
30ms Script
application/javascript 2600:9000:214f:5a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:5a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 10:01:19 GMT
content-encoding: gzip
age: 4963193
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA53-C1
content-type: application/javascript
x-amz-cf-id: aTzato9juxmoTst6A2A3w6MsTTjP7Lg9Z0md07k09GMZIOUnNvOzrA==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C7C4 43 B
216 B 541ms
168ms Image
image/gif 44.236.8.70
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=906442&asId=dfd7e134-21a9-8007-c621-6cac1e0f3ba8&tv=%7Bc:1S8sFb,pingTime:-3,time:70,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:17%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:70,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B65~0%5D,as:%5B65~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sV5L5qb+11%7C12%7C13%7C141%7C151%7C161%7C162%7C17*.906442-60231624%7C171,idMap:17*,rmeas:1,rend:0,renddet:IMG.us%7D&br=c
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.236.8.70 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-236-8-70.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-server-name: dt18.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C7C4 43 B
215 B 539ms
169ms Image
image/gif 44.236.8.70
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=906442&asId=dfd7e134-21a9-8007-c621-6cac1e0f3ba8&tv=%7Bc:1S8sFc,pingTime:-6,time:71,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:71,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B66~0%5D,as:%5B66~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sV5L5qb+11%7C12%7C13%7C141%7C151%7C161%7C162%7C17*.906442-60231624%7C171,idMap:17*,rmeas:1,rend:0,renddet:IMG.us%7D&tpiLookup=ao:wallpaperaccess.com*&br=c
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.236.8.70 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-236-8-70.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-server-name: dt19.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 55C0 0
23 B 61ms
61ms Ping
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 20 Jan 2022 20:41:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A12F 1 KB
749 B 24ms
23ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 20 Jan 2022 13:26:12 GMT
expires: Fri, 21 Jan 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 26099
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 55C0 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e8a7ed5f5931abb7906a01a6c19be2b00db1a41dd59ff08aead9ab129bda6b3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET /
google2waycm.netmng.com/cm/ Frame F886 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F886
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEfKzF5CFIfbpsKQcRzP1tk&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEfKzF5CFIfbpsKQcRzP1tk&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bUFMVENlRGsxTmFFZjU1&google_gid=CAESEEfKzF5CFIfbpsKQcRzP1tk&google_cver=1&google_push=AYg5qPIh1U9UFYoq14bKY4R2PdfZm93SSnSu2ZCYOu3JdJK...

170 B
188 B

58ms
58ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bUFMVENlRGsxTmFFZjU1&google_gid=CAESEEfKzF5CFIfbpsKQcRzP1tk&google_cver=1&google_push=AYg5qPIh1U9UFYoq14bKY4R2PdfZm93SSnSu2ZCYOu3JdJKKhmJhHPAkO1Dl8U2UiyDw4_EZSfINxiUizd9CKTLxZoo5l5LFRGqt

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:11 GMT
Server: PingMatch/v2.0.30-693-g87a8e09#rel-ec2-master i-007d40ea11cf721ba@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bUFMVENlRGsxTmFFZjU1&google_gid=CAESEEfKzF5CFIfbpsKQcRzP1tk&google_cver=1&google_push=AYg5qPIh1U9UFYoq14bKY4R2PdfZm93SSnSu2ZCYOu3JdJKKhmJhHPAkO1Dl8U2UiyDw4_EZSfINxiUizd9CKTLxZoo5l5LFRGqt
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F886
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEA8qCotYQgHhC6Md8g7_tl0&google_cver=1&google_push=AYg5qPIqIbvLWZfpXseZaPLDl1GW7icg3qyUr_XUw0jBND6HOG_qHLuwWF_V2tbCR-Up6DdGdlDC1gbLhlWZWKLF...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIqIbvLWZfpXseZaPLDl1GW7icg3qyUr_XUw0jBND6HOG_qHLuwWF_V2tbCR-Up6DdGdlDC1gbLhlWZWKLFo5hNAtfZ8iFC

170 B
188 B

36ms
36ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIqIbvLWZfpXseZaPLDl1GW7icg3qyUr_XUw0jBND6HOG_qHLuwWF_V2tbCR-Up6DdGdlDC1gbLhlWZWKLFo5hNAtfZ8iFC

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 20 Jan 2022 20:41:11 GMT
Server: MT3 4133 baa842e master zrh-pixel-x25 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIqIbvLWZfpXseZaPLDl1GW7icg3qyUr_XUw0jBND6HOG_qHLuwWF_V2tbCR-Up6DdGdlDC1gbLhlWZWKLFo5hNAtfZ8iFC
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 20 Jan 2022 20:41:10 GMT

GET

pixel
cm.g.doubleclick.net/ Frame F886
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&google_cver=1&google_gid=CAESEBfkkLiQZWuFPKFMnFZxvpQ&google_push=AYg5qPKWEg-aCwYqJ0kTmPfvIUTZJ9GxwIYFq...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F886
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBUAyxt9ZEdlpGEaNcexdP4&google_cver=1&google_push=AYg5qPKQOBdN-LPHATEUYq76tepT0A2QbaW9FKjqyKHgWXcibjzgEMCdoWtYva4SXX3JMwfL1slgOm-Rdb4vYQKBj...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEBUAyxt9ZEdlpGEaNcexdP4&google_cver=1&google_push=AYg5qPKQOBdN-LPHATEUYq76tepT0A2QbaW9FKjqyKHgWXcibjzgEMCdoWtYva4SXX3JMwfL1slgOm-Rdb4vYQKBj...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPKQOBdN-LPHATEUYq76tepT0A2QbaW9FKjqyKHgWXcibjzgEMCdoWtYva4SXX3JMwfL1slgOm-Rdb4vYQKBjTxgml2OMz8&google_hm=fcbdab739c162b8d662ed3a5

170 B
188 B

24ms
24ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPKQOBdN-LPHATEUYq76tepT0A2QbaW9FKjqyKHgWXcibjzgEMCdoWtYva4SXX3JMwfL1slgOm-Rdb4vYQKBjTxgml2OMz8&google_hm=fcbdab739c162b8d662ed3a5

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 20 Jan 2022 20:41:12 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPKQOBdN-LPHATEUYq76tepT0A2QbaW9FKjqyKHgWXcibjzgEMCdoWtYva4SXX3JMwfL1slgOm-Rdb4vYQKBjTxgml2OMz8&google_hm=fcbdab739c162b8d662ed3a5
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame F886 0
75 B 190ms
113ms Image
text/plain 185.86.139.104
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEO_NugaGZX5P8Y-ee4TYvj8&google_cver=1&google_push=AYg5qPLM3EYvGvNFxsgSxXxBg35vbVrERxMziEtIfwRsGQ4KzdeJrLn5SoXvzQ3pDjESC6tWGZkSf5j2nnmmy5JOYjwodQVcvv2k
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F886
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECV1GumYYVa6K3wBU8_qC5w&google_cver=1&google_push=AYg5qPLxQao_ENEuhgQC106TDal1V2BpywC3_W0oEM04_ugCzpff0F0l8fyYbBETEO27JBUsEg...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECV1GumYYVa6K3wBU8_qC5w&google_cver=1&google_push=AYg5qPLxQao_ENEuhgQC106TDal1V2BpywC3_W0oEM04_ugCzpff0F0l8fyYbBETEO27JBUsEg...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS13OGRhR0JSRTJ1SFA2UmNTeEFxNTFyQVd6UFBZcFd6cX5B&google_push=AYg5qPLxQao_ENEuhgQC106TDal1V2BpywC3_W0oEM04_ugCzpff0F0l8...

170 B
188 B

65ms
65ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS13OGRhR0JSRTJ1SFA2UmNTeEFxNTFyQVd6UFBZcFd6cX5B&google_push=AYg5qPLxQao_ENEuhgQC106TDal1V2BpywC3_W0oEM04_ugCzpff0F0l8fyYbBETEO27JBUsEgnrQbouzYVyNo72KUnMg1IEsQnapQ

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS13OGRhR0JSRTJ1SFA2UmNTeEFxNTFyQVd6UFBZcFd6cX5B&google_push=AYg5qPLxQao_ENEuhgQC106TDal1V2BpywC3_W0oEM04_ugCzpff0F0l8fyYbBETEO27JBUsEgnrQbouzYVyNo72KUnMg1IEsQnapQ
date: Thu, 20 Jan 2022 20:41:11 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F886 0
12 B 37ms
36ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I04ryTjF3-WoWKftk9ArA8v46RdwR6s9zFpNVWTaycpSRRT3UNfjUtgFJAwch8S2YqSuAcQQ

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C7C4 43 B
215 B 516ms
168ms Image
image/gif 44.236.8.70
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=906442&asId=dfd7e134-21a9-8007-c621-6cac1e0f3ba8&tv=%7Bc:1S8sFA,pingTime:-2,time:95,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:908,beZ:909,mfA:911,cmA:912,inA:912,inZ:915,prA:915,prZ:919,si:927,poA:933,poZ:962,cmZ:962,mfZ:962,loA:979,loZ:982,ltA:1003,ltZ:1003%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:17%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:95,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B90~0%5D,as:%5B90~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sV5L5qb+11%7C12%7C13%7C141%7C151%7C161%7C162%7C17*.906442-60231624%7C171,idMap:17*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:IMG.us,sinceFw:70,readyFired:false%7D&br=c
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.236.8.70 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-236-8-70.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-server-name: dt20.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 139B 22 KB
8 KB 29ms
29ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Jan 2022 08:48:03 GMT
expires: Thu, 19 Jan 2023 08:48:03 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 129188
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8BCE 22 KB
8 KB 28ms
28ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/automatad-wallpaperaccess/b-f821a95-2d5d7ed2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 19 Jan 2022 08:48:03 GMT
expires: Thu, 19 Jan 2023 08:48:03 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 129188
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame 8449 81 KB
11 KB 166ms
125ms Stylesheet
text/css 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1kzkr67gg6bfa6h196c9wjv4msv9wyff3zndhq5zrnjwfkc2829de0cm5mtzfhdxmn2vd26011mgeeqqbrdek09wtn5k6caf69bqtsaane9ekxb6t8nv7vrwtna4cxvda56mxfyrs8x4wst6pngr25b58qyasa5wttwjc5krxh9d16kjgpapk5cen9qrmzbqt9jyq4t4erkkkdm2n65ggrp32rtqbeapna8ngc3scyhg3dj6z5hzmkagmbsfjzzrwr1d896d13k8r3gh3fvgwcgj3mmq4yh3ck1qzhwwt7wjggrm61741s9647dxsv5t08ndt1b535t4xn215ekgr3r3ta3a2n9ttan25d31wxaet0a2qam3skkgd4aswnpnbxm7kj4qgh4f1zxfmrsah9rcrtcxv18z1e2t4q5ht6svx94kcddg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%26client%3Dca-pub-8648432769746717%26adurl%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1kzkr67gg6bfa6h196c9wjv4msv9wyff3zndhq5zrnjwfkc2829de0cm5mtzfhdxmn2vd26011mgeeqqbrdek09wtn5k6caf69bqtsaane9ekxb6t8nv7vrwtna4cxvda56mxfyrs8x4wst6pngr25b58qyasa5wttwjc5krxh9d16kjgpapk5cen9qrmzbqt9jyq4t4erkkkdm2n65ggrp32rtqbeapna8ngc3scyhg3dj6z5hzmkagmbsfjzzrwr1d896d13k8r3gh3fvgwcgj3mmq4yh3ck1qzhwwt7wjggrm61741s9647dxsv5t08ndt1b535t4xn215ekgr3r3ta3a2n9ttan25d31wxaet0a2qam3skkgd4aswnpnbxm7kj4qgh4f1zxfmrsah9rcrtcxv18z1e2t4q5ht6svx94kcddg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%26client%3Dca-pub-8648432769746717%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age: 706566
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=83581
surrogate-control: no-store
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains; preload
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: same-origin
expires: 0
last-modified: Wed, 12 Jan 2022 16:25:05 GMT
server: cloudflare
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options: noopen
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=3600, must-revalidate, proxy-revalidate
cf-ray: 6d0b1f4948f7839c-MXP
cf-bgj: minify

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame 8449 36 KB
13 KB 57ms
57ms Script
application/javascript 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1kzkr67gg6bfa6h196c9wjv4msv9wyff3zndhq5zrnjwfkc2829de0cm5mtzfhdxmn2vd26011mgeeqqbrdek09wtn5k6caf69bqtsaane9ekxb6t8nv7vrwtna4cxvda56mxfyrs8x4wst6pngr25b58qyasa5wttwjc5krxh9d16kjgpapk5cen9qrmzbqt9jyq4t4erkkkdm2n65ggrp32rtqbeapna8ngc3scyhg3dj6z5hzmkagmbsfjzzrwr1d896d13k8r3gh3fvgwcgj3mmq4yh3ck1qzhwwt7wjggrm61741s9647dxsv5t08ndt1b535t4xn215ekgr3r3ta3a2n9ttan25d31wxaet0a2qam3skkgd4aswnpnbxm7kj4qgh4f1zxfmrsah9rcrtcxv18z1e2t4q5ht6svx94kcddg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%26client%3Dca-pub-8648432769746717%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b98c8f3aa7cc2835be32fd3a1488ba31a3de35a3fa0dd643a092c2846c613017

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=i2G9+Q==, md5=KT4B161Aam0qyQ5N1n+FMQ==
date: Thu, 20 Jan 2022 20:41:11 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 20696
x-guploader-uploadid: ADPycdtXvXkNTikigjdIbYNhxiQLD-4AZAv9bzOL91Gi0Vasqu-NthMEIEUtuuiuVaKDT9UyXdL8EGeHFPeRkpk5qsfqo-CjnA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 02 Nov 2021 14:54:41 GMT
server: cloudflare
etag: W/"293e01d7ad406a6d2ac90e4dd67f8531"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UiNaibQNpAdokVnmE1VPu1pP7tLMh2e%2ByrWeAw7UXq1RgJZ1YPEEkf14%2F49G2o2JoZ9HEIdVdgyBnrc6iaXI3RbdJcuRY7r4KFGHlCbXz8lnorKppHGYqjMMny61bJuN8r03NLg%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1635864881199576
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
x-goog-stored-content-length: 11933
cf-ray: 6d0b1f49095d5a25-MXP
expires: Thu, 20 Jan 2022 14:56:15 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame A12F
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEGUowouz3AYR_id5BNruYUk&google_cver=1&google_push=AYg5qPILsivjWb-vHMNYlqHym-Bn7tplGj2uCE2GdSZzczt-TSDu02mqWeckFUbp1aLbJKUpntyqayHsyXJe34AHSl_yweUbtKWEH...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEGUowouz3AYR_id5BNruYUk&google_cver=1&google_push=AYg5qPILsivjWb-vHMNYlqHym-Bn7tplGj2uCE2GdSZzczt-TSDu02mqWeckFUbp1aLbJKUpntyqayHsyXJe34AHSl_yweUbtKW...

43 B
411 B

205ms
196ms

Image
image/gif

2606:4700::6812:c05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEGUowouz3AYR_id5BNruYUk&google_cver=1&google_push=AYg5qPILsivjWb-vHMNYlqHym-Bn7tplGj2uCE2GdSZzczt-TSDu02mqWeckFUbp1aLbJKUpntyqayHsyXJe34AHSl_yweUbtKWEHw&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPILsivjWb-vHMNYlqHym-Bn7tplGj2uCE2GdSZzczt-TSDu02mqWeckFUbp1aLbJKUpntyqayHsyXJe34AHSl_yweUbtKWEHw%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6d0b1f4aeb38d608-MXP
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1377
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6d0b1f49893dd608-MXP
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEGUowouz3AYR_id5BNruYUk&google_cver=1&google_push=AYg5qPILsivjWb-vHMNYlqHym-Bn7tplGj2uCE2GdSZzczt-TSDu02mqWeckFUbp1aLbJKUpntyqayHsyXJe34AHSl_yweUbtKWEHw&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPILsivjWb-vHMNYlqHym-Bn7tplGj2uCE2GdSZzczt-TSDu02mqWeckFUbp1aLbJKUpntyqayHsyXJe34AHSl_yweUbtKWEHw%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A12F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEML65Ojx0cRNyFq8gnqaLJE&google_push=AYg5qPKDUSi-Kc7ii574R3YPeFn5wJYmoHzo6IWD-2XacVAOpU7SKEye6m...

170 B
188 B

44ms
44ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEML65Ojx0cRNyFq8gnqaLJE&google_push=AYg5qPKDUSi-Kc7ii574R3YPeFn5wJYmoHzo6IWD-2XacVAOpU7SKEye6mBp34BP3bH-sA-Oit-GzYHmw0mJ3jJkhMExEvVM2lyb

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1642711272.930324,VS0,VE97
x-served-by: cache-mxp6936-MXP
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEML65Ojx0cRNyFq8gnqaLJE&google_push=AYg5qPKDUSi-Kc7ii574R3YPeFn5wJYmoHzo6IWD-2XacVAOpU7SKEye6mBp34BP3bH-sA-Oit-GzYHmw0mJ3jJkhMExEvVM2lyb
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame A12F 0
191 B 130ms
48ms Image
text/plain 66.155.71.149
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEAQ6UbBBkNrRNCPg9T61kGE&google_cver=1&google_push=AYg5qPLz0sBJv62eA3-npXcXpJB09FhKSzr3TQMcxr36yCSCsxQE-sDujV5-HlC2QZ2d-TZGfZ-sV_OoMhdp7pHbCkJAi1ko_Enq
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A12F
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEA-89gvMvqRfCBbXydNn6eY&google_cver=1&google_push=AYg5qPIWy81XPkyWyYg5qVP-G1vkTwetA1BXx4f3JOj7Ql7hBnCDf3k412mbfxxa91H9DZKH5Pw2EOqIv_JPMm_WhBfCItV...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEA-89gvMvqRfCBbXydNn6eY&google_cver=1&google_push=AYg5qPIWy81XPkyWyYg5qVP-G1vkTwetA1BXx4f3JOj7Ql7hBnCDf3k412mbfxxa91H9DZKH5Pw2EOqIv_JPMm_WhBfCI...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPIWy81XPkyWyYg5qVP-G1vkTwetA1BXx4f3JOj7Ql7hBnCDf3k412mbfxxa91H9DZKH5Pw2EOqIv_JPMm_WhBfCItVPj8q2nQ

170 B
188 B

36ms
35ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPIWy81XPkyWyYg5qVP-G1vkTwetA1BXx4f3JOj7Ql7hBnCDf3k412mbfxxa91H9DZKH5Pw2EOqIv_JPMm_WhBfCItVPj8q2nQ

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPIWy81XPkyWyYg5qVP-G1vkTwetA1BXx4f3JOj7Ql7hBnCDf3k412mbfxxa91H9DZKH5Pw2EOqIv_JPMm_WhBfCItVPj8q2nQ
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A12F
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEP8gbKTHwg5gub3SJyFHdcs&google_cver=1&google_push=AYg5qPLmN26YNQPLSI1hmGEHWEB16FHaXMWe55-cb7akDOlpXDoQ1N7IZcOT8pNS_Lk07cA0kzlk-0Sf...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEP8gbKTHwg5gub3SJyFHdcs&google_cver=1&google_push=AYg5qPLmN26YNQPLSI1hmGEHWEB16FHaXMWe55-cb7akDOlpXDoQ1N7IZcOT8pNS_Lk07cA0kzl...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTA5MTU0OTU4NDk3NjE0NzkzMg&google_push=AYg5qPLmN26YNQPLSI1hmGEHWEB16FHaXMWe55-cb7akDOlpXDoQ1N7IZcOT8pNS_Lk07cA0kzlk-0...

170 B
188 B

41ms
40ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTA5MTU0OTU4NDk3NjE0NzkzMg&google_push=AYg5qPLmN26YNQPLSI1hmGEHWEB16FHaXMWe55-cb7akDOlpXDoQ1N7IZcOT8pNS_Lk07cA0kzlk-0SfDmSUoY5ZsrmzxocYpJkFWQ

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTA5MTU0OTU4NDk3NjE0NzkzMg&google_push=AYg5qPLmN26YNQPLSI1hmGEHWEB16FHaXMWe55-cb7akDOlpXDoQ1N7IZcOT8pNS_Lk07cA0kzlk-0SfDmSUoY5ZsrmzxocYpJkFWQ
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A12F
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=zJ3gJoC6T2GLHa3nGWWh6A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

59ms
59ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=zJ3gJoC6T2GLHa3nGWWh6A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKUCuFhoH5sjOKXGvl0mM8Z0532z8noKO90B_okqH6bi-3QWIDl7JqDG-AmXeLVaIEnV4-tA22-VQWh19iMkt3ftA1fxTWGMw

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=zJ3gJoC6T2GLHa3nGWWh6A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKUCuFhoH5sjOKXGvl0mM8Z0532z8noKO90B_okqH6bi-3QWIDl7JqDG-AmXeLVaIEnV4-tA22-VQWh19iMkt3ftA1fxTWGMw
date: Thu, 20 Jan 2022 20:41:11 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET

pixel
cm.g.doubleclick.net/ Frame A12F
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEPr5ZczKOQPFc5R9ONOSnhk&google_cver=1&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlqstf7FCY...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEPr5ZczKOQPFc5R9ONOSnhk&google_cver=1&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlqs...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=n6fikEFqTJuwu973d3OAuw&google_push=AYg5qPKHzoru3Ly6g-WJN63r4nx22LW57M46DlhgjEtrLL4tEhbsKlyi_8wp0bRUpNcmPd305BW0YGX8I2AEXlq...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A12F 0
12 B 32ms
32ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JxM9jKOSBOWbW9kDakGRUNbJOaWjx1N8HdkATqvY4rsjHJKV3hA21now7RCR5Ek6JFMOvn

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 IAS_PassbackAds_160x600.png
static.adsafeprotected.com/ Frame C7C4 16 KB
17 KB 22ms
22ms Image
image/png 2600:9000:214f:5a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_160x600.png
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:5a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 13340dfc25a96d245772fb41c7aa01c32723b80d8dd8240864b747610d2ff745

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:23:13 GMT
via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
age: 573478
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 16777
last-modified: Wed, 21 Jul 2021 22:11:22 GMT
server: AmazonS3
etag: "eef84d4a7321b73260b41707db98756f"
x-amz-version-id: WuQcaoubBkKKClUdkO2IbwsDhqoJfzyt
cache-control: max-age=604800
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: J9VTsgeZ0C_MIWnjniU0zstZPczUBesvYjC6Wp-bR4bt1Wwvc28KIw==

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 514A 1 KB
749 B 25ms
25ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 20 Jan 2022 13:26:12 GMT
expires: Fri, 21 Jan 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 26099
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C7C4 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ffb3cb9b070b27e88f499154c9c938a03ce82cdd76792b36eae7f4b97863638c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js Show response
pagead2.googlesyndication.com/bg/ Frame 139B 35 KB
13 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4528ca9e4e601b97be627ab26a891a181a1f44161c990df96f9996037005ed78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 16:38:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14554
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13497
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Jan 2023 16:38:37 GMT

GET
H3 200 RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js Show response
pagead2.googlesyndication.com/bg/ Frame 8BCE 35 KB
13 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/RSjKnk5gG5e-YnqyaokaGBofRBYcmQ35b5mWA3AF7Xg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4528ca9e4e601b97be627ab26a891a181a1f44161c990df96f9996037005ed78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 16:38:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14554
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13497
x-xss-protection: 0
last-modified: Wed, 12 Jan 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Jan 2023 16:38:37 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 514A
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEEMaQNvYeeAKghplDiY_VWw&google_cver=1&google_push=AYg5qPLzWT4Cm7nBTbL8cq7YoqMxy6_l7wv72SeH3tWuT03ct7X6xma8vb7vxD-wY50PPxg-wuNcRBC7UPqH5cSvuo3g9_0yGUo
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mjg0MDM0MzIxMDY1NzE3MjU0Mg==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGa7NAKhIZTOB6mqmTs-s5M&google_cver=1

43 B
407 B

20ms
20ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGa7NAKhIZTOB6mqmTs-s5M&google_cver=1
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGa7NAKhIZTOB6mqmTs-s5M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 514A 35 B
463 B 124ms
48ms Image
image/gif 2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJAYlEjiwcjVXgVOkbAt4AM&google_cver=1&google_push=AYg5qPK5orovQeQnIlF6StZhurQRoqIhwaUBs6XA4dFSITizMc5oQPmiimiKmUpxYxuF0gNuyaKCc-mI8KAHsD7sNbdeN05vqsM

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 514A
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEOmj9zRO5qA0d8p5LS5_cmY&google_cver=1&google_push=AYg5qPLlKex2GH0pXRVfFry8_CCQ4tj-8uLPxXQKqrGyC1a1_-xxQ2d81-07u8aivWERm3-GLZ4ZlJx_anKQMiNZkiQyJeDMGKk
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=BD010C5F9DB040D09C969C58D616CB32&google_push=AYg5qPLlKex2GH0pXRVfFry8_CCQ4tj-8uLPxXQKqrGyC1a1_-xxQ2d81-07u8aivWERm3-GLZ4ZlJx_anKQMiN...

170 B
188 B

33ms
32ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=BD010C5F9DB040D09C969C58D616CB32&google_push=AYg5qPLlKex2GH0pXRVfFry8_CCQ4tj-8uLPxXQKqrGyC1a1_-xxQ2d81-07u8aivWERm3-GLZ4ZlJx_anKQMiNZkiQyJeDMGKk

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 20 Jan 2022 20:41:12 GMT
x-content-type-options: nosniff
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=BD010C5F9DB040D09C969C58D616CB32&google_push=AYg5qPLlKex2GH0pXRVfFry8_CCQ4tj-8uLPxXQKqrGyC1a1_-xxQ2d81-07u8aivWERm3-GLZ4ZlJx_anKQMiNZkiQyJeDMGKk
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Wed, 19 Jan 2022 20:41:12 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 514A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPorQkU0fQxtrwdVBh_s1t0&google_cver=1&google_push=AYg5qPLz5xNTbowikpOYILqr1PIvIsd69EDfQTra_x3gLDhPnRBSG47gVDTdQi8YnVQc_pvgoMq...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lORlZMTlQtSS1FRjZL&google_push=AYg5qPLz5xNTbowikpOYILqr1PIvIsd69EDfQTra_x3gLDhPnRBSG47gVDTdQi8YnVQc_pvgoMqbBxO5TWajX9UnukZI91T7qoY

170 B
188 B

29ms
29ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lORlZMTlQtSS1FRjZL&google_push=AYg5qPLz5xNTbowikpOYILqr1PIvIsd69EDfQTra_x3gLDhPnRBSG47gVDTdQi8YnVQc_pvgoMqbBxO5TWajX9UnukZI91T7qoY

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lORlZMTlQtSS1FRjZL&google_push=AYg5qPLz5xNTbowikpOYILqr1PIvIsd69EDfQTra_x3gLDhPnRBSG47gVDTdQi8YnVQc_pvgoMqbBxO5TWajX9UnukZI91T7qoY
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 514A
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEM...
https://sync.targeting.unrulymedia.com/csync/RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPKSaR3eO-wMVJ6lKceXo...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPKSaR3eO-wMVJ6lKceXo8LvNwJM9J2wdIPxuV5wxd4L3OpaXECf3_NBU7QB0DaPcs-s5NkRU2huI1dXz7W-tpd0TaLGfw&google_hm=A_6mjvkF_EyFog3WWV4JSgA

170 B
188 B

35ms
34ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPKSaR3eO-wMVJ6lKceXo8LvNwJM9J2wdIPxuV5wxd4L3OpaXECf3_NBU7QB0DaPcs-s5NkRU2huI1dXz7W-tpd0TaLGfw&google_hm=A_6mjvkF_EyFog3WWV4JSgA

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPKSaR3eO-wMVJ6lKceXo8LvNwJM9J2wdIPxuV5wxd4L3OpaXECf3_NBU7QB0DaPcs-s5NkRU2huI1dXz7W-tpd0TaLGfw&google_hm=A_6mjvkF_EyFog3WWV4JSgA
date: Thu, 20 Jan 2022 20:41:12 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXfea68ef905fc4c85a20dd6595e094a00003
content-type: text/html

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 514A 0
75 B 133ms
49ms Image
text/plain 185.86.139.104
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEO_NugaGZX5P8Y-ee4TYvj8&google_cver=1&google_push=AYg5qPIIO-D4-wrmUEUUNNndzA-GgzsGoRIBUzxjHzq0fnMyF3Pf4PLJV791REWONYSr-DPPhswHA7XhppYrs1RNb2sg-VTWtWo
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 514A
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEEyn0m7i2wX2NsVow89BoUw&google_cver=1&google_push=AYg5qPIUk5qj9x87hUawYfCdtcMtGqWi5ZHmBbyiv4zyBEC8sbx7IfR3...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEEyn0m7i2wX2NsVow89BoUw&google_cver=1&google_push=AYg5qPIUk5qj9x87hUawYfCdtcMtGqWi5ZHmBbyiv4zyBEC8sbx7IfR3...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEEyn0m7i2wX2NsVow89BoUw&google_cver=1&google_push=AYg5qPIUk5qj9x87hUawYfCdtcMtGqWi5ZHmBbyiv4zyBEC8sbx7If...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA0ZGRjZTEyYi03YTMxLTExZWMtYTc3ZS0wMmFjNGEzOTQ2ZjQ%3D&google_push=AYg5qPIUk5qj9x87hUawYfCdtcMtGqWi5ZHmBbyiv4zyBEC8sbx7IfR3pfG5D2Vmqt...

170 B
188 B

36ms
34ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA0ZGRjZTEyYi03YTMxLTExZWMtYTc3ZS0wMmFjNGEzOTQ2ZjQ%3D&google_push=AYg5qPIUk5qj9x87hUawYfCdtcMtGqWi5ZHmBbyiv4zyBEC8sbx7IfR3pfG5D2Vmqt876A1AgnZzuCqHWoJL4us8EpYTJWRtMdts

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA0ZGRjZTEyYi03YTMxLTExZWMtYTc3ZS0wMmFjNGEzOTQ2ZjQ%3D&google_push=AYg5qPIUk5qj9x87hUawYfCdtcMtGqWi5ZHmBbyiv4zyBEC8sbx7IfR3pfG5D2Vmqt876A1AgnZzuCqHWoJL4us8EpYTJWRtMdts
date: Thu, 20 Jan 2022 20:41:12 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 514A 0
12 B 26ms
25ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K66awAP6drLsFM4jWCHnYto3xFQ-2I19W4uopzs0DzKOFutXvozlpRSCWUBqPyHpjaxgOaLA

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 visitormatch Show response
bh.contextweb.com/ Frame B3EF 27 B
497 B 354ms
112ms Document
text/html 198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch

Requested by

Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_I1Ssr0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(9.4.14.v20181114) /

Resource Hash

ec2f44e7dbd2ebb1268ac7e7a0602ec2106bc7fd9da17b9012db81be55cbd485

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server: bh-deployment-775b5b88b7-qkpfc
cache-control: private, max-age=0, no-cache, no-store
expires: -1
content-language: de-DE
content-type: text/html;charset=iso-8859-1
server: Jetty(9.4.14.v20181114)
strict-transport-security: max-age=15768000

GET
H2 204 cs
sync.rtk.io/ Frame 60D7 0
0 127ms
119ms Document
text/plain 147.75.64.214
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.rtk.io/cs
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_I1Ssr0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.64.214 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS: adstorm-pk-nj-101
Software: nginx/1.20.1 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

server: nginx/1.20.1
date: Thu, 20 Jan 2022 20:41:12 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 6998 52 KB
17 KB 119ms
22ms Document
text/html 92.122.253.36
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_I1Ssr0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.253.36 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-253-36.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.18.0 (Ubuntu)
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Fri, 21 Jan 2022 20:41:14 GMT
Date: Thu, 20 Jan 2022 20:41:12 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 showad.js Show response
ads.pubmatic.com/AdServer/js/ Frame BDE9 38 KB
14 KB 120ms
23ms Document
text/html 92.122.252.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_I1Ssr0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.252.114 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-252-114.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 877fa64eb78a65e1b23fef6c4acd56fd991c23f286250122e75c89b97e2cd405

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

last-modified: Tue, 11 Jan 2022 05:13:08 GMT
etag: "1302647-9687-5d547824a78f1"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 13928
content-type: text/html; charset=UTF-8
cache-control: public, max-age=116972
expires: Sat, 22 Jan 2022 05:10:44 GMT
date: Thu, 20 Jan 2022 20:41:12 GMT
vary: Accept-Encoding

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 9D5A 8 KB
4 KB 144ms
11ms Document
text/html 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: b2cdn.automatad.com
URL: https://b2cdn.automatad.com/js/prebid_I1Ssr0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bbfd30e5fd2bd475d319b5b55ab61469966d1517b703f9bd830a6f3207387c27

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wallpaperaccess.com/

Response headers

cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Wed, 15 Dec 2021 19:31:35 GMT
accept-ranges: bytes
etag: "32347ab14bd5257f1f3d2e210ba82276"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: dmt1yBBLs4pu0V2Kh8VKWcZdR9I6s/BLsxGkYLbJ5x4gNABUH34NkBi1GQgeExqW0TaavTbg1Yw=
x-amz-request-id: Q2BDEC5GWP4399D4
x-amz-meta-codebuild-content-sha256: 8644b4f52d5a37b8f0b84f0bbcfa66f9e0f7f97407e4d25c13a055f86b22baed
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:0897103a-6355-4b89-92f6-53a82b1da700
x-amz-meta-codebuild-content-md5: 276cf0a41034befc9a603617ae1a1731
x-azure-ref-originshield: 0HKfpYQAAAACcjsmshb1/QpugV4UwnbSXQU1TMDRFREdFMTkxNQA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 06MjpYQAAAABo62COuU1SRara1lSb3aPXRlJBRURHRTEwMDcAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
date: Thu, 20 Jan 2022 20:41:11 GMT

GET
H2 200 adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame 8449 3 KB
4 KB 127ms
38ms Image
image/png 2606:4700:20::ac43:444e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:444e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
date: Thu, 20 Jan 2022 20:41:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4213586
x-guploader-uploadid: ADPycds9UegxUXswK4RzZzF6mXDfQy_y0GHXQmo_7EYAAHyEQ16keq-zOTSqb6YP04oikMtdLFTYNybr6iTpruHRyi30S7TEFw
x-goog-storage-class: STANDARD
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3262
x-goog-meta-
last-modified: Wed, 09 Jun 2021 12:35:14 GMT
server: cloudflare
etag: "794c84d30e213ec6a144d64215f07551"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ar26UNSM1AT%2BoX8F%2FP6Lp3UDTvEjMqzVjVyZTdfaUzKe1v222yKsBXqJAbmdb%2Fexjk%2Fc3DSkgFKyoP1jALmWkad%2BWiQldpGxmuGKikxiyRrrUB9Vpke9nY5GwxqJq4Md0iIalbiO8GDh4Y8O5MygSW41"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1623242114099744
content-type: image/png
cache-control: public, max-age=31536000, immutable
x-goog-stored-content-length: 3262
accept-ranges: bytes
cf-ray: 6d0b1f4aac6a374d-MXP
expires: Sat, 03 Dec 2022 02:14:46 GMT

GET
H3 200 frame.html Show response
ad4m.at/ Frame 8B9E 2 KB
2 KB 62ms
62ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: text/html; charset=utf-8
x-guploader-uploadid: ADPycdunJgVlrvJk1i4V6EeqzatPhaSnLm6oIWOTelRdPaqnkcFkkR_BCVkP3mYoCL4WPcEUy1UhJuTUv7ryZUo5tpCgVZe-wQ
expires: Thu, 20 Jan 2022 21:41:12 GMT
last-modified: Wed, 06 May 2020 15:09:30 GMT
x-goog-generation: 1588777770164783
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1681
x-goog-meta-
x-goog-custom-time: 1970-01-01T00:00:00Z
content-language: en
x-goog-hash: crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-storage-class: MULTI_REGIONAL
cache-control: public, max-age=3600
age: 1535686
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vlVXBXzp6CRmDn%2FChtLLZcuqDcbva%2F%2BhaLJeQvFVYfDPc51%2F0pPZkhPUDFfnSxVP3MZSz8V7H57rElLcCnlbTPwI83Y8%2FZNRI9UBKyiP4QoMNaYgkyI3bCbvI3eK9bRQ1D7tbag%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 6d0b1f4a4c79839c-MXP
content-encoding: br

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 139B 0
20 B 45ms
45ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQfzD58jpYaLjCKaP7_UP3caWsA4AAAAAOAHgBAI&bg=!09Cl0JTNAAZ_DxPPfw87ACkAdvg8WrX8I8Cc6tCXw1c7aQYTmLQqTYPGkOaggK-Ox1-7WtzHAF-1yAIAAACMUgAAAAJoAQeZAxqe9xV4C_Ow4gdx2GaeKReYx8mBHIk463TqHyJjUFFtPi8fcLAgvF90Y-vJz6r6zO-n-thkSMx458NtCkRIooLUGfwCXNCcHbVo87dBq5xYGgef2ItrAFl_kOk_kQSABGTG1NNZRnm-Wm3zVRD_-OD60ea6iP-tcbH7906aNvTRlv-s8Ssh9R6Xm5pC4fLMPVDohrgsmUDR5-vvP5VaZGhmhYxUJerQHPL3OwEKbSsrcBFoFjx0c1hr5YJ-JvDGiskj3yMGIVkj-6UTzW6d61JIoNORGUApS0Ru19CaKunWmkfprzu5VUwdyiOOU178Z4bPsMd7e9J9U0SMw36VDg_6Ilnh_R8qETfW8e5P1zIdRoeFQr3lf9JRTUor_Y8LJJFSwARu2nKv2gs8Ruujo2-XMFSTcbBJrT2L6pk9Dap8-FQP6tUVuFvI48bFAAFExLfdQnElUBC9f-heXMKkwVUmwjn7IjBGgGQdVE8BEvIs-9prfNQXnGLrvjnZ5Md9JjoCBR-JXyWesTErDP7_r6Z67H48lpxvm0mo3TvLGABE3if72vVupsDD1g4U34p__LQcfcJEG1463iBLVIwFkA-4nQ1ineyIcF03wzAb8GrH7SwYO2wNi2mPagnh01RTnN0Rd6u9CwR9cf-Ad8qtppg23qVHq5rfASg3lE_-5LmuBfMy10aUfoPJiyWdnafWhcm4mwBurIOty7ZATJ3pORCVaxAlS6Cy31nM-lWR95Y_vpST6hvb6Bxzr5nKpyoZCUw-Fc4aqdkby554rVgt9-7Bv_h4oH_p_hS3FlwTgQAAx5YQufjhUMQxuCpWILX6aUYObbbrh7fg3JKxVw8pjaDop8vHu0A8c6cPtzZ8i9r9QIhLHoJFHF1qYg4KvI1af4pWm1H2ukYuKiz1CmqcZq7Q_zv4AIBlwwp08XnAoeHU5Ld489c0g0c_TAfkrHFFR5ZBT42gdiCcigp1fDkyBXQs6cJqfbzN-spGP7uo6q4HhiEA4N1E_JDYX13_t9bky9-QyStLIrnOmJhtJB9XG2feXCLJVuepJrOlYg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6998 0
729 B 32ms
32ms Script
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

b6.89.32a9.ip4.static.sl-reverse.com

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
X-Proxy-Origin: 217.64.151.6; 217.64.151.6; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9223f2ef-9c19-4f31-aff0-ce4896c46185
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame BDE9 5 KB
6 KB 14ms
14ms Script
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=7535937&p=160148&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 13ee26fd47af132426e19315a080f1f88876714ff567e942c915690c28f7416e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8BCE 0
20 B 44ms
44ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BhTQS58jpYbqIIsST7_UPoPqPwAQAAAAAOAHgBAI&bg=!srGlsfXNAAZ_DxPPfw87ACkAdvg8Ws4pv4vbmhaila69ckRW2kQyWuNx3XMfRtzIiEz-QmMgnMup8AIAAACeUgAAAAJoAQeZAxBsElFdL7NIHWVVDdqaYceDxVsCblVkrikPDOaX2kVX5Tk-ZjBw9dgBxcwPGdVYZrQYyb8oKR_pzbEBBl761O43S4SnuHJMg6pfweJXKeVwGNLwK6zU8tQFbqxpBCoudXFa7Tbp7pKjio6QJhlQo2ABX92YPdIn7xfois1iyJFkoRFtWpQ_IK1bRa4oftVCP884Bq_JxO-hTAs9yJRQkTYQCc8ekeOzKvMCcv2yn2DUzq2G_7IA-PLUr-ciTQrn5wt2tYH_eZ78gGXl332LAkUVow00kGoXsFweQqrrDoPyc1cmL4UG-loHCIyUgNJOYr3G7iINbUpqr4Ft-WrD2mNZf8TnfgWqXJlXxBrbkeJg5mTgiPZ-AxghPX-bkK_fGeCaQWIvxzsm6ppPX72lPIqMHs8UvmX1heLH4wNoqIg6ywkha6sijuUZv952QoxFwdW1xnpWOgJykSycYl2wNAgpmAQem9kjuxQlhsPVYKC4kPHgA8Mp_peOdEBlRchNi6BwaKD41qbOuWak0xG3cwD2bDlr00XOf4Q1qmcDX7cZeeHI1p57ToFDT2xSvKXfVy1y0t0LP6n8K5hQdcinG8pNhaKfuU5cXW7rAiA5ghCojo2S0ZTY_KZTDoEiPzsRM6DY-riqwRkJ1vElknKHnX8l3ldbhSd1JZ2FPmsMPl2nRD0MxhbvYUNuMb8scqOrgIHX_2nhtswNEs1y33x1zqXQ3DqM5N0gI7yXHr9QOFLHsHzhuK73Tbhru17cOo0oyI96Hs8hujjMKjIrtglGNocxM_0xp-2io01mVGAl88MdVWYWUBI5x3Gdv6Gz6EbcHOP8N37MgB6rqYkn6IJ_BBd4a1kOpVhevFKBHdwqNcEw2ieOUlgReWFdEuomKigDZsN42LuHQm6BIOdt5hYuJb8uPKcgFTiR6FJ_H7_tFNN8scL9xs_QF3jZ0yriwKt891FsvmbwQnGD9IWQuCSQ4ZOscWhhHPTWCyFtPOyQ9sx93INem1NJ-kmUIKHPIQXjIX3CYv2TzQYctjNCFiexF5rV

Requested by

Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame CAEB 4 KB
2 KB 106ms
40ms Document
text/html 18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2056d5a79a162314ec01ecaba2576085defeada1a87242561fc4b82af6467562

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: text/html;charset=UTF-8
server: nginx
etag: W/"019194485e0ad836aa27951cf62726bd0"
timing-allow-origin: *
content-encoding: gzip

GET
H2 204 ps
pixel.33across.com/ Frame C9B0 0
0 420ms
153ms Document
text/plain 67.202.105.21
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.21 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip21.67-202-105.static.steadfastdns.net
Software: 33XP002 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

x-33x-status: 2000208
server: 33XP002
date: Thu, 20 Jan 2022 20:41:12 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 6532 2 KB
814 B 36ms
12ms Document
text/html 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 0E5C 780 B
1 KB 19ms
18ms Document
text/html 185.86.139.104
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: a899b4de5ff86844a9d78395c36762c3050ebbf1a40f572dbe62313fe046a023

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
content-type: text/html
content-length: 780

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame CA6A 1 KB
3 KB 41ms
40ms Document
text/html 92.122.254.129
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.254.129 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-254-129.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1a6952a7968fc5f8cd323bd27167540b72ef8eebd5ca1954fe42627c62ccad43

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 39|230|241|73|8|4|218|176
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Expires: Thu, 20 Jan 2022 20:41:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
Content-Length: 1460
Connection: keep-alive

GET
H2

200

sync
ads.servenobid.com/ Frame 9D5A
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=7704875731775957928

0
344 B

58ms
56ms

Image
image/avif

176.34.169.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=7704875731775957928
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 176.34.169.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-169-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
X-Proxy-Origin: 217.64.151.6; 217.64.151.6; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 2f1d8165-ac5e-4589-9453-e3d6d3c6b263
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=7704875731775957928
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 9D5A
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ads.servenobid.com/sync?pid=310&uid=fcbdab739c162b8d662ed3a5

0
347 B

56ms
56ms

Image
image/avif

176.34.169.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=fcbdab739c162b8d662ed3a5
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 176.34.169.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-169-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=fcbdab739c162b8d662ed3a5
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap5ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 9D5A
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4219486017
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4219486017
https://sync.1rx.io/usersync/tradedesk/70ee61dc-f506-4ecf-95ba-c931aad7452b
https://sync.targeting.unrulymedia.com/csync/RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003
https://rtb.gumgum.com/usersync?b=rhy&i=RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003

35 B
208 B

92ms
91ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=rhy&i=RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=rhy&i=RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003
date: Thu, 20 Jan 2022 20:41:12 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXfea68ef905fc4c85a20dd6595e094a00003
content-type: text/html

GET
H2 200 101954
jadserve.postrelease.com/suid/ Frame 9D5A 43 B
427 B 375ms
145ms Image
image/gif 54.173.185.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/101954?ntv_r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D322%26uid%3DNTV_USER_ID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.173.185.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-173-185-122.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 9D5A
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5107433822416673900

0
344 B

59ms
57ms

Image
image/avif

176.34.169.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5107433822416673900
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 176.34.169.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-169-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5107433822416673900
Date: Thu, 20 Jan 2022 20:41:12 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usa
sync.go.sonobi.com/ Frame 9D5A 0
478 B 64ms
17ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 9D5A
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=03f1f43f-5ea2-4537-b155-6ebf162f5fb4&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
356 B

89ms
89ms

Image
image/avif

176.34.169.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=03f1f43f-5ea2-4537-b155-6ebf162f5fb4&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 176.34.169.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-169-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=03f1f43f-5ea2-4537-b155-6ebf162f5fb4&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 0
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 9D5A
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-uYlqAlpE2uGaYVY1xPKmbB3JbQ4FcU1gqzRZycE-~A

0
367 B

33ms
33ms

Image
image/avif

176.34.169.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-uYlqAlpE2uGaYVY1xPKmbB3JbQ4FcU1gqzRZycE-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 176.34.169.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-169-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-uYlqAlpE2uGaYVY1xPKmbB3JbQ4FcU1gqzRZycE-~A
date: Thu, 20 Jan 2022 20:41:12 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame C7BA 35 B
467 B 23ms
22ms Document
image/gif 37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=CC9DE026-80BA-4F61-8B1D-ADE71965A1E8

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 82C1
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6069535722806300950

42 B
520 B

123ms
38ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6069535722806300950
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Thu, 20 Jan 2022 16:58:11 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: amspug0027:0:405
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6069535722806300950
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9BC8
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:1ae461e9-c8e7-4300-9ed4-c04b1e6af543&gdpr=0&gdpr_consent=

42 B
338 B

139ms
43ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:1ae461e9-c8e7-4300-9ed4-c04b1e6af543&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: lhrpug014:0:530
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Date: Thu, 20 Jan 2022 20:41:12 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Access-Control-Allow-Origin: *
Server: MT3 4133 baa842e master zrh-pixel-x8 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:1ae461e9-c8e7-4300-9ed4-c04b1e6af543&gdpr=0&gdpr_consent=
Expires: Thu, 20 Jan 2022 20:41:11 GMT

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame 129C 43 B
362 B 92ms
44ms Document
image/gif 178.250.0.163
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif
server: Kestrel
cache-control: no-cache
pragma: no-cache
expires: Thu, 20 Jan 2022 00:00:00 GMT
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 617199
strict-transport-security: max-age=31536000; preload;

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3421
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=9
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7055391190015932564

42 B
518 B

94ms
42ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7055391190015932564
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: lhrpug020:0:378
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Server: nginx
Date: Thu, 20 Jan 2022 20:41:12 GMT
Transfer-Encoding: chunked
Connection: keep-alive
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7055391190015932564

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 5E9B
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...

85 B
166 B

39ms
39ms

Document
image/png

151.101.194.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YenI6AAADNJLSQAy
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

content-type: image/png
server: Jetty(9.4.35.v20201120)
accept-ranges: bytes
date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 varnish
age: 2787
x-served-by: cache-mxp6936-MXP
x-cache: HIT
x-cache-hits: 15171
x-timer: S1642711272.358507,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 85

Redirect headers

p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YenI6AAADNJLSQAy
server: Jetty(9.4.35.v20201120)
accept-ranges: bytes
date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 varnish
x-served-by: cache-mxp6936-MXP
x-cache: MISS
x-cache-hits: 0
x-timer: S1642711272.217025,VS0,VE93
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E8D0
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=Na8hhBFOSG1QsvKU-xAIx9lAlwY

42 B
218 B

45ms
44ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=Na8hhBFOSG1QsvKU-xAIx9lAlwY
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: lhrpug001:0:479
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Content-Type: text/html; charset=utf-8
Date: Thu, 20 Jan 2022 20:41:12 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=Na8hhBFOSG1QsvKU-xAIx9lAlwY
Content-Length: 159
Connection: keep-alive

GET
H/1.1

200
OK

redir Show response
rtb-csync.smartadserver.com/ Frame D1F4
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFV3NVN0QwNUlBQUVIVjRKMmxPQQ&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEWsU7D05IAAEHV4J2lOA&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_curre...

43 B
163 B

23ms
23ms

Document
image/gif

185.86.137.133
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEWsU7D05IAAEHV4J2lOA&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.133 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif
transfer-encoding: chunked

Redirect headers

Date: Thu, 20 Jan 2022 20:41:12 GMT
location: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEWsU7D05IAAEHV4J2lOA&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2%26userid%3DSMART_USER_ID
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 0
Connection: keep-alive

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 2ACF
Redirect Chain

https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0

0
107 B

80ms
43ms

Document
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: text/html; charset=utf-8
x-lat: lhrpug017:2:289
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private
content-encoding: gzip

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
content-length: 0
date: Thu, 20 Jan 2022 20:41:12 GMT
server: _

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 6B2F
Redirect Chain

https://green.erne.co/pubmatic/cm?
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=ubs15FFR76802Id5rXhwYL4Z

42 B
369 B

59ms
39ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=ubs15FFR76802Id5rXhwYL4Z
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Thu, 20 Jan 2022 20:41:11 GMT
content-type: image/gif; charset=utf-8
content-length: 42
x-lat: amspug004:0:643
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: openresty
date: Thu, 20 Jan 2022 20:41:12 GMT
content-length: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=ubs15FFR76802Id5rXhwYL4Z
strict-transport-security: max-age=0; includeSubDomains;

GET
H3 200 i.match Show response
a.tribalfusion.com/ Frame F932 43 B
670 B 265ms
229ms Document
image/gif 2606:4700::6812:c05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif; charset=utf-8
content-length: 43
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 302
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6d0b1f4baabdd618-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 404 dpe Show response
ad4m.at/ad/ Frame 0E43 15 B
837 B 60ms
59ms Document
text/plain 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6420ab9ec6ebff1cd61333dade6ba9ac879d3617a59334148672dee6af12fec

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: text/plain; charset=utf-8
content-length: 15
report-to: {"endpoints":[{"url":"https://as.ad4m.at/ad/vre"}],"group":"report-endpoint","max_age":86400}
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0"}
expires: 0
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
content-security-policy: block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
referrer-policy: same-origin
pragma: no-cache
surrogate-control: no-store
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6d0b1f4b6835839c-MXP

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 2BED
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8485552858
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8485552858
https://sync.1rx.io/usersync/tradedesk/c46bf148-bb94-470d-acd7-63813061f6a4
https://sync.targeting.unrulymedia.com/csync/RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003
https://rtb.gumgum.com/usersync?b=rhy&i=RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003

35 B
208 B

100ms
100ms

Document
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=rhy&i=RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

server: Tengine
date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: text/html
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://rtb.gumgum.com/usersync?b=rhy&i=RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003
etag: RXfea68ef905fc4c85a20dd6595e094a00003

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 514B 43 B
277 B 215ms
53ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Vary: Accept-Encoding
X-adserver-worker: komodo-bdf2fbfc1956@version_1.367
Connection: close
X-server-arch: v2
Content-Type: image/gif
Content-Length: 43
X-core-time: 1ms
Date: Thu, 20 Jan 2022 20:41:12 GMT

GET
H2

200

rtb-h Show response
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame 7881
Redirect Chain

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=f38b80b5-479a-4554-89af-e6e5d6606545-tuct8e34e68&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...

0
148 B

259ms
112ms

Document
text/plain

151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=f38b80b5-479a-4554-89af-e6e5d6606545-tuct8e34e68&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
accept-ranges: bytes
date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 varnish
x-served-by: cache-mxp6932-MXP
x-cache: MISS
x-cache-hits: 0
x-timer: S1642711273.567951,VS0,VE26
content-length: 0

Redirect headers

server: nginx
location: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=f38b80b5-479a-4554-89af-e6e5d6606545-tuct8e34e68&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges: bytes
date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 varnish
x-served-by: cache-mxp6953-MXP
x-cache: MISS
x-cache-hits: 0
x-timer: S1642711272.318322,VS0,VE27
x-vcl-time-ms: 27
content-length: 0

GET
H/1.1 200
OK bridge Show response
cm.adgrx.com/ Frame 2D8E 43 B
408 B 564ms
198ms Document
image/gif 216.52.31.73
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 216.52.31.73 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS: sjc-delivery-7.sys.adgear.com
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Date: Thu, 20 Jan 2022 20:41:12 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
server: Cowboy
X-RealServer-NX: sjc-delivery-7
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: Thu, 23 Sep 2004 17:42:04 GMT
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame BDE9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=zJ3gJoC6T2GLHa3nGWWh6A%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

14 KB
14 KB

46ms
46ms

Image
text/html

92.122.252.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 92.122.252.114 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-252-114.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-encoding: gzip
last-modified: Tue, 15 Jun 2021 06:08:03 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3945-5c4c7cc02bd56"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=83872
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5054
expires: Fri, 21 Jan 2022 19:59:04 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1ae461e9-c8e7-4300-9ed4-c04b1e6af543

0
127 B

150ms
43ms

Image
text/plain

185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1ae461e9-c8e7-4300-9ed4-c04b1e6af543
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:10 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Thu, 20 Jan 2022 20:41:12 GMT
Server: MT3 4133 baa842e master zrh-pixel-x2 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1ae461e9-c8e7-4300-9ed4-c04b1e6af543
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 20 Jan 2022 20:41:11 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame BDE9
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=CC9DE026-80BA-4F61-8B1D-ADE71965A1E8
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1
https://pixel.onaudience.com/?partner=147&mapped=b675afe1-fe0a-4090-b7ba-3fcc47c8b1a1&icm
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D
https://sync.crwdcntrl.net/map/ct=y/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=16e2a0f7259ff3f5ec8cea6e08c08437
https://spl.zeotap.com/?zdid=1332&zcluid=0fd634b46de7d751
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=ea9bcf50-6467-4984-428d-588e569337cb&reqId=c634c0e1-c42f-454a-6d8a-9939781a9c8d&zclui...
https://mwzeom.zeotap.com/mw?google_gid=CAESEL_1bweU3nAjTSMCHLA9PtY&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=ea9bcf50-6467-4984-428d-588e569337cb&reqId=c634c0e1-c42f-454a-6d8a-993...

95 B
164 B

56ms
56ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?google_gid=CAESEL_1bweU3nAjTSMCHLA9PtY&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=ea9bcf50-6467-4984-428d-588e569337cb&reqId=c634c0e1-c42f-454a-6d8a-9939781a9c8d&zcluid=0fd634b46de7d751&zdid=1332
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:13 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://ads.pubmatic.com
access-control-allow-credentials: true
cf-ray: 6d0b1f526d2d59b3-MXP
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:13 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://mwzeom.zeotap.com/mw?google_gid=CAESEL_1bweU3nAjTSMCHLA9PtY&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=ea9bcf50-6467-4984-428d-588e569337cb&reqId=c634c0e1-c42f-454a-6d8a-9939781a9c8d&zcluid=0fd634b46de7d751&zdid=1332
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 469
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0M5REUwMjYtODBCQS00RjYxLThCMUQtQURFNzE5NjVBMUU4&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
186 B

87ms
38ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-store, no-cache, private
x-lat: amspug006:0:330
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEN7cLD29owP2C2UX-p2sEic&google_cver=1

42 B
279 B

98ms
39ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEN7cLD29owP2C2UX-p2sEic&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: no-store, no-cache, private
x-lat: amspug019:0:749
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEN7cLD29owP2C2UX-p2sEic&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame BDE9 43 B
409 B 47ms
42ms Image
image/gif 169.50.137.182
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

169.50.137.182 , United States, ASN36351 (SOFTLAYER, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Wed, 19 Jan 2022 20:41:12 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=1091549584976147932

42 B
233 B

94ms
45ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=1091549584976147932
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug015:0:618
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=1091549584976147932
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=b675afe1-fe0a-4090-b7ba-3fcc47c8b1a1

42 B
291 B

46ms
46ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=b675afe1-fe0a-4090-b7ba-3fcc47c8b1a1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug010:0:588
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=b675afe1-fe0a-4090-b7ba-3fcc47c8b1a1
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7704875731775957928&gdpr=0&gdpr_consent=

42 B
233 B

88ms
40ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7704875731775957928&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: no-store, no-cache, private
x-lat: amspug002:0:933
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
X-Proxy-Origin: 217.64.151.6; 217.64.151.6; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: c41b3b25-6566-443a-9401-2ef2bc865bd7
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7704875731775957928&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=20wowI5FKMHATXmb1U5gnd1KKM7AHnuc1U0AVc34

42 B
466 B

99ms
40ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=20wowI5FKMHATXmb1U5gnd1KKM7AHnuc1U0AVc34
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 16:57:55 GMT
cache-control: no-store, no-cache, private
x-lat: amspug0022:0:501
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=20wowI5FKMHATXmb1U5gnd1KKM7AHnuc1U0AVc34
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 CC9DE026-80BA-4F61-8B1D-ADE71965A1E8
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame BDE9 43 B
870 B 155ms
50ms Image
image/gif 2a05:d018:d29:3601:58ff:414:f08:16d6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/CC9DE026-80BA-4F61-8B1D-ADE71965A1E8?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3601:58ff:414:f08:16d6 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=CC9DE026-80BA-4F61-8B1D-ADE71965A1E8&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Xwk0FO9E2uVt6wUSljhxqL8cEqUUqtI-~A&gdpr=0&gdpr_consent=

0
260 B

151ms
43ms

Image
text/plain

185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Xwk0FO9E2uVt6wUSljhxqL8cEqUUqtI-~A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 18:23:05 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Xwk0FO9E2uVt6wUSljhxqL8cEqUUqtI-~A&gdpr=0&gdpr_consent=
date: Thu, 20 Jan 2022 20:41:12 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://p.rfihub.com/cm?in=1&pub=20513&ssp=pubmatic
https://x.bidswitch.net/sync?dsp_id=119&user_id=5107433822416673900&expires=30&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=5e9bf4e9-806f-45a4-9c23-b15ed9b1164a&gdpr=&gdpr_consent=&gdpr_pd=

1 B
181 B

74ms
74ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=5e9bf4e9-806f-45a4-9c23-b15ed9b1164a&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug019:0:499
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=5e9bf4e9-806f-45a4-9c23-b15ed9b1164a&gdpr=&gdpr_consent=&gdpr_pd=
Date: Thu, 20 Jan 2022 20:41:12 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2840343210657172542&gdpr=0&gdpr_consent=&us_privacy=

1 B
167 B

93ms
44ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2840343210657172542&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug030:0:592
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2840343210657172542&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 204 current
pubmatic-match.dotomi.com/match/bounce/ Frame BDE9 0
104 B 137ms
80ms Image
text/plain 2a02:fa8:8806:20::2040
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=CC9DE026-80BA-4F61-8B1D-ADE71965A1E8&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2040 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:bb472006-db4c-428f-92c3-401576a7fdac&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
111 B

41ms
41ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:bb472006-db4c-428f-92c3-401576a7fdac&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug028:0:385
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:bb472006-db4c-428f-92c3-401576a7fdac&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Thu, 20 Jan 2022 20:41:12 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=no-consent&gdpr=1&gdpr_consent=

42 B
360 B

97ms
39ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=no-consent&gdpr=1&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 16:54:36 GMT
cache-control: no-store, no-cache, private
x-lat: amspug0021:0:360
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=no-consent&gdpr=1&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame BDE9
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7704875731775957928

42 B
110 B

59ms
59ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7704875731775957928
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug022:0:626
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
X-Proxy-Origin: 217.64.151.6; 217.64.151.6; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 7e960a00-7f83-40cd-b7de-2bf861287c62
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7704875731775957928
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame 0E5C 0
344 B 50ms
49ms Image
image/avif 176.34.169.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=3628424041640991115&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.34.169.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-169-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2 204 get_user_agent_id
cookie-matching.mediarithmics.com/v1/ Frame 0E5C 0
85 B 134ms
41ms Image
text/plain 213.32.46.50
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cookie-matching.mediarithmics.com/v1/get_user_agent_id?dom_token=smart17&gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

213.32.46.50 , France, ASN16276 (OVH, FR),

Reverse DNS

ip50.ip-213-32-46.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;includeSubDomains;preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
strict-transport-security: max-age=63072000;includeSubDomains;preload

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 0E5C
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%4...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=8fed142a-0003-4f1a-865f-b0bc3d464da1&gdpr=0&gdpr_consent=

43 B
425 B

136ms
53ms

Image
image/gif

185.86.137.133
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=8fed142a-0003-4f1a-865f-b0bc3d464da1&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.137.133 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
server: Kestrel
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=8fed142a-0003-4f1a-865f-b0bc3d464da1&gdpr=0&gdpr_consent=
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 6401021
content-length: 0
expires: Thu, 20 Jan 2022 00:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 0E5C
Redirect Chain

https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=
https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=&s_h=1
https://rtb-csync.smartadserver.com/redir/?partnerid=96&partneruserid=4567e732-ea75-45a0-92f6-3de5be65b17f&gdpr=0&gdpr_consent=

43 B
448 B

72ms
71ms

Image
image/gif

185.86.137.133
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=96&partneruserid=4567e732-ea75-45a0-92f6-3de5be65b17f&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.137.133 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: Apache-Coyote/1.1
location: https://rtb-csync.smartadserver.com/redir/?partnerid=96&partneruserid=4567e732-ea75-45a0-92f6-3de5be65b17f&gdpr=0&gdpr_consent=
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
x-xss-protection: 1; mode=block
expires: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 0E5C
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1091549584976147932&gdpr=0&gdpr_consent=

43 B
408 B

141ms
54ms

Image
image/gif

185.86.137.133
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1091549584976147932&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.137.133 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1091549584976147932&gdpr=0&gdpr_consent=
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C7C4 43 B
215 B 194ms
191ms Image
image/gif 44.236.8.70
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=906442&asId=dfd7e134-21a9-8007-c621-6cac1e0f3ba8&tv=%7Bc:1S8sMn,pingTime:-10,time:516,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85Ny4wLjQ2OTIuNzEgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000020000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1642711272231%7C%7Cb51ec22b7cb529dee3789a7155e346b7%7C%7C8866308252d63f9bf74b74e606896148%7C%7C238f6f55cc6f88ad12b5019afba4f4fa%7C%7Cd05229369f5d125223df4eec3a012fbf%7C%7Cd764cab1cce66eadf86cd16c17879b90%7C%7C8cd5b37b1b723136afd1811337acca52%7C%7C8088bc37e683f00462934d96b8a24ff7%7C%7C1629390669%7D
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.236.8.70 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-236-8-70.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-server-name: dt15.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

POST
H3 200 rs Show response
ad4m.at/ Frame 8449 2 KB
2 KB 91ms
91ms XHR
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fc2eb04e0bdb269f0e54dc6a235f701b79200c0969313cb70cac37e3aac48d2

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

cf-ray: 6d0b1f4c989883af-MXP
date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ehOfeBlanUecsEQzSTGcsIxJRqVOUJRswZgJBcZM17ojCvelylhs9CEVTuYF2XNrwgReHbg6%2FMkVCKBqjko2k4tOY5m9JVUVycMRrbl4Td4cu3nOE2FWa%2FfwFyWYXUdpeDb7cho%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://as.ad4m.at
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
access-control-allow-credentials: true
content-encoding: br
x-backend-server: aa-reachservice-group-europe-west1-f4nk

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 130ms
75ms Preflight
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://as.ad4m.at
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: text/plain
content-length: 24
access-control-allow-origin: https://as.ad4m.at
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-headers: content-type
allow: HEAD,POST,GET,OPTIONS
x-backend-server: aa-reachservice-group-europe-west1-f4nk
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9xwMWOjdw%2BFCORwvLDTqyKTzrKOmP6lYnRNUsslWRy8i6Tfob4WV9YFj4QBV%2FYVI9VW9p1nMj6gMq4YyoVOVzFFBl8c%2FfrMFSYgNtKGuXl2YIgSUc0LeFfgmgTsfsGjLu0NMSZA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6d0b1f4c1f4083af-MXP

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame CA6A 70 B
264 B 58ms
57ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame CA6A 170 B
188 B 61ms
61ms Image
image/png 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame CA6A
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&dcc=t

43 B
645 B

122ms
122ms

Image
image/gif

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

HTTP/1.1

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: RZRK0R177N5005R6W7KW
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 0BDE1J1YYK7DZ5CEBPVB
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 YenI5_Ld1B82xGffLVzS_gAABKkAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame CA6A 43 B
870 B 84ms
51ms Image
image/gif 2a05:d018:d29:3601:58ff:414:f08:16d6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YenI5_Ld1B82xGffLVzS_gAABKkAAAIB?gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3601:58ff:414:f08:16d6 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame CA6A
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=c5c4329e-22f6-426c-aeb9-6b90fb38878a&expiration=1674247272

43 B
1 KB

54ms
53ms

Image
image/gif

92.122.254.129
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=c5c4329e-22f6-426c-aeb9-6b90fb38878a&expiration=1674247272
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 92.122.254.129 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-254-129.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 20 Jan 2022 20:41:12 GMT

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=c5c4329e-22f6-426c-aeb9-6b90fb38878a&expiration=1674247272
date: Thu, 20 Jan 2022 20:41:12 GMT
server: Kestrel
content-length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame CA6A
Redirect Chain

https://ad.turn.com/r/cs?pid=21&gdpr=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2840343210657172542

43 B
1 KB

73ms
73ms

Image
image/gif

92.122.254.129
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2840343210657172542
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Server: 92.122.254.129 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-254-129.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 20 Jan 2022 20:41:12 GMT

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2840343210657172542
pragma: no-cache
date: Thu, 20 Jan 2022 20:41:11 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1 200
OK ibs:dpid=23728&dpuuid=YenI5-Ld1B82xGffLVzS-gAA%261193
dpm.demdex.net/ Frame CA6A 0
0 321ms
102ms Image
application/json 34.250.134.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpm.demdex.net/ibs:dpid=23728&dpuuid=YenI5-Ld1B82xGffLVzS-gAA%261193?gdpr_consent=&us_privacy=&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.134.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-134-201.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 113
match.deepintent.com/usersync/ Frame CA6A 0
44 B 413ms
145ms Image
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/113
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
content-length: 0
server: b

GET
H2 200 sync
ads.servenobid.com/ Frame CA6A 0
356 B 63ms
62ms Image
image/avif 176.34.169.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=YenI5_Ld1B82xGffLVzS_gAABKkAAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.34.169.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-169-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
https://rtb.gumgum.com/usersync?b=apn&i=7704875731775957928

35 B
208 B

97ms
97ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=apn&i=7704875731775957928
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
X-Proxy-Origin: 217.64.151.6; 217.64.151.6; 723.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 2f7b3448-a69a-4f7c-944a-47d1192d7573
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://rtb.gumgum.com/usersync?b=apn&i=7704875731775957928
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_e0390680-71e0-4c5e-97aa-1d71e21bd045&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_e0390680-71e0-4c5e-97aa-1d71e21bd045&gdpr=0&gdpr_consent=&us_privacy=1---
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=gumgum2
https://x.bidswitch.net/sync?dsp_id=70&user_id=1091549584976147932&ssp=gumgum2
https://rtb.gumgum.com/usersync?b=bsw&i=5e9bf4e9-806f-45a4-9c23-b15ed9b1164a

35 B
208 B

98ms
98ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=bsw&i=5e9bf4e9-806f-45a4-9c23-b15ed9b1164a
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: //rtb.gumgum.com/usersync?b=bsw&i=5e9bf4e9-806f-45a4-9c23-b15ed9b1164a
Date: Thu, 20 Jan 2022 20:41:12 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2

200

/
tempsyncurl.com/ Frame CAEB
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
https://rtb.gumgum.com/usersync?b=obn&i=ENC%28MsD3F3W_mN7KJW14OtMAZrvidzAOar9C8ly-weGMPRdYTIqstdC3WbnqsmxkBx5m%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_e0390680-71e0-4c5e-97aa-1d71e21bd045&obuid=ENC(MsD3F3W_mN7KJW14OtMAZrvidzAOar9C8ly-weGMPRdYTIqstdC3WbnqsmxkBx5m)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://tempsyncurl.com/

0
0

503ms
165ms

Image
text/html

139.99.9.116
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tempsyncurl.com/
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 139.99.9.116 Singapore, Singapore, ASN16276 (OVH, FR),
Reverse DNS: ns541483.ip-139-99-9.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Redirect headers

Location: http://tempsyncurl.com/
Date: Thu, 20 Jan 2022 20:41:13 GMT
X-TraceId: 8c4795aaef74eda06b0848b1a277adb7
Content-Length: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://rtb.gumgum.com/usersync?b=opx&i=6c8a4cde-ed11-48cc-b48b-203a00b193a0

35 B
208 B

85ms
85ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=opx&i=6c8a4cde-ed11-48cc-b48b-203a00b193a0
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://rtb.gumgum.com/usersync?b=opx&i=6c8a4cde-ed11-48cc-b48b-203a00b193a0
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=sta&i=0-3c958bb8-c923-4b74-425b-9b98e321dee0$ip$217.64.151.6

35 B
208 B

48ms
48ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sta&i=0-3c958bb8-c923-4b74-425b-9b98e321dee0$ip$217.64.151.6
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=sta&i=0-3c958bb8-c923-4b74-425b-9b98e321dee0$ip$217.64.151.6
Date: Thu, 20 Jan 2022 20:41:12 GMT
Connection: keep-alive
Content-Length: 121
Content-Type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=oth&i=y-UfxDjcRE2pdOdYz4YJSz5PKcphOd8HipCuEE~A

35 B
208 B

69ms
68ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=oth&i=y-UfxDjcRE2pdOdYz4YJSz5PKcphOd8HipCuEE~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Thu, 20 Jan 2022 20:41:12 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://rtb.gumgum.com/usersync?b=oth&i=y-UfxDjcRE2pdOdYz4YJSz5PKcphOd8HipCuEE~A
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
https://rtb.gumgum.com/usersync?b=vnt&i=4e540cea-7a31-11ec-8237-bda483b54b18

35 B
208 B

44ms
44ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=vnt&i=4e540cea-7a31-11ec-8237-bda483b54b18
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=vnt&i=4e540cea-7a31-11ec-8237-bda483b54b18
Date: Thu, 20 Jan 2022 20:41:11 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 4e540ceb-7a31-11ec-8237-bda483b54b18

GET
H2 204 services
sync.technoratimedia.com/ Frame CAEB 0
293 B 413ms
146ms Image
text/plain 193.122.174.27
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 193.122.174.27 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 835653243
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame CAEB 0
16 B 409ms
145ms Image
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
content-length: 0
server: b

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_e0390680-71e0-4c5e-97aa-1d71e21bd045&gdpr=0&gdpr_consent=&us_privacy=1---
https://stags.bluekai.com/site/23178?id=S_haiitny_gmsytmUu9R&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2U27NBQWS2LUNZ4V6Z3NON4XI3KVOU4VEJTVONPXA...
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=S_haiitny_gmsytmUu9R&us_privacy=1---

35 B
208 B

64ms
64ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=S_haiitny_gmsytmUu9R&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:13 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:13 GMT
P3p: CP="We do not support P3P header."
Location: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=S_haiitny_gmsytmUu9R&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 118
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://rtb.gumgum.com/usersync?b=idi&i=9fa7e290-416a-4c9b-b0bb-def7777380bb

35 B
208 B

72ms
68ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=idi&i=9fa7e290-416a-4c9b-b0bb-def7777380bb
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=idi&i=9fa7e290-416a-4c9b-b0bb-def7777380bb
date: Thu, 20 Jan 2022 20:41:12 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8182676848
https://sync.1rx.io/usersync/tradedesk/70ee61dc-f506-4ecf-95ba-c931aad7452b
https://sync.targeting.unrulymedia.com/csync/RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003
https://rtb.gumgum.com/usersync?b=rhy&i=RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003

35 B
208 B

89ms
87ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=rhy&i=RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=rhy&i=RX-fea68ef9-05fc-4c85-a20d-d6595e094a00-003
date: Thu, 20 Jan 2022 20:41:12 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXfea68ef905fc4c85a20dd6595e094a00003
content-type: text/html

GET
H2

200

usersync
rtb.gumgum.com/ Frame CAEB
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=IgJ6gkJfGnIS&ev=1&pid=558355

35 B
208 B

96ms
96ms

Image
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=IgJ6gkJfGnIS&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: de-DE
location: https://rtb.gumgum.com/usersync?b=pln&i=IgJ6gkJfGnIS&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-775b5b88b7-5xjxx
expires: -1

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame CAEB 0
75 B 80ms
79ms Image
text/plain 185.86.139.104
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:11 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame CAEB 0
357 B 4812ms
4809ms Image
image/avif 176.34.169.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_e0390680-71e0-4c5e-97aa-1d71e21bd045
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.34.169.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-176-34-169-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:17 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 94DA
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://rtb.gumgum.com/usersync?b=mmh&i=1ae461e9-c8e7-4300-9ed4-c04b1e6af543&gdpr=0&gdpr_consent=

35 B
208 B

70ms
53ms

Document
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=mmh&i=1ae461e9-c8e7-4300-9ed4-c04b1e6af543&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Date: Thu, 20 Jan 2022 20:41:12 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Access-Control-Allow-Origin: *
Server: MT3 4133 baa842e master zrh-pixel-x1 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://rtb.gumgum.com/usersync?b=mmh&i=1ae461e9-c8e7-4300-9ed4-c04b1e6af543&gdpr=0&gdpr_consent=
Expires: Thu, 20 Jan 2022 20:41:11 GMT

GET
H2

200

URnmbSKM Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame CC9F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YenI6AAADBchXQBH

85 B
149 B

83ms
83ms

Document
image/png

151.101.194.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YenI6AAADBchXQBH
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

content-type: image/png
server: Jetty(9.4.35.v20201120)
accept-ranges: bytes
date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 varnish
age: 2787
x-served-by: cache-mxp6936-MXP
x-cache: HIT
x-cache-hits: 15172
x-timer: S1642711272.490294,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 85

Redirect headers

p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YenI6AAADBchXQBH
server: Jetty(9.4.35.v20201120)
accept-ranges: bytes
date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 varnish
x-served-by: cache-mxp6936-MXP
x-cache: MISS
x-cache-hits: 0
x-timer: S1642711272.319106,VS0,VE101
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame AC22 170 B
188 B 76ms
75ms Document
image/png 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9lMDM5MDY4MC03MWUwLTRjNWUtOTdhYS0xZDcxZTIxYmQwNDU=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

content-type: image/png
date: Thu, 20 Jan 2022 20:41:12 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
server: HTTP server (unknown)
content-length: 170
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 5D53 14 KB
5 KB 42ms
41ms Document
text/html 92.122.252.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.252.114 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-252-114.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=83872
expires: Fri, 21 Jan 2022 19:59:04 GMT
date: Thu, 20 Jan 2022 20:41:12 GMT
vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 858B 0
0 466ms
150ms Document
text/plain 67.202.105.21
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.21 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip21.67-202-105.static.steadfastdns.net
Software: 33XP002 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

x-33x-status: 2000208
server: 33XP002
date: Thu, 20 Jan 2022 20:41:12 GMT

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame FBF8
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=b675afe1-fe0a-4090-b7ba-3fcc47c8b1a1&t=1645303272

35 B
208 B

94ms
94ms

Document
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=b675afe1-fe0a-4090-b7ba-3fcc47c8b1a1&t=1645303272
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=b675afe1-fe0a-4090-b7ba-3fcc47c8b1a1&t=1645303272
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame F6FF
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

178ms
59ms

Document
text/html

184.30.209.152
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.209.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-209-152.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "40014-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 20 Jan 2022 20:41:12 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?p=gumgum
date: Thu, 20 Jan 2022 20:41:12 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H2 204 um
cs.emxdgt.com/ Frame BFDF 0
0 284ms
64ms Document
text/html 18.195.155.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

content-type: text/html
date: Thu, 20 Jan 2022 20:41:11 GMT
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 52D8
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://rtb.gumgum.com/usersync?b=sus&i=YenI6cCo5ugAALKjfncAAAAA

35 B
208 B

73ms
73ms

Document
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=sus&i=YenI6cCo5ugAALKjfncAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Thu, 20 Jan 2022 20:41:13 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Server: nginx
Date: Thu, 20 Jan 2022 20:41:13 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private
Location: https://rtb.gumgum.com/usersync?b=sus&i=YenI6cCo5ugAALKjfncAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time: 3
X-SO-HostName: m-ad217.dc4p.scaleout.jp
X-SO-LB-Hostname: a-tgng40017.dc2p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":25,"gdpr":true,"ipv4":"0.0.0.0","key":"YenI6cCo5ugAALKjfncAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad217"}
X-SO-Key: YenI6cCo5ugAALKjfncAAAAA
X-SO-IP: 217.64.151.6
X-SO-Cluster-ID: 25
X-SO-Upstream-ID: m-ad217

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame EF83
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://rtb.gumgum.com/usersync?b=rth&i=cUsOMkpFXpD7fJeZ0Xn9&pi=gumgum&tc=1

35 B
208 B

98ms
98ms

Document
image/gif

18.203.130.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=rth&i=cUsOMkpFXpD7fJeZ0Xn9&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.130.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-130-18.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Thu, 20 Jan 2022 20:41:12 GMT Thu, 20 Jan 2022 20:41:12 GMT
location: https://rtb.gumgum.com/usersync?b=rth&i=cUsOMkpFXpD7fJeZ0Xn9&pi=gumgum&tc=1
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C7C4 43 B
215 B 439ms
437ms Image
image/gif 44.236.8.70
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=906442&asId=dfd7e134-21a9-8007-c621-6cac1e0f3ba8&tv=%7Bc:1S8sNX,time:614,type:e,im:%7Bpci:%7Btdr:545%7D%7D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:614,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B609~0%5D,as:%5B609~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:542,fm:sV5L5qb+11%7C12%7C13%7C141%7C151%7C161%7C162%7C17*.906442-60231624%7C171,idMap:17*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=c
Requested by: Host: b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com
URL: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.236.8.70 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-236-8-70.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-server-name: dt17.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 rar Show response
as.ad4m.at/ad/ Frame A05D 7 KB
4 KB 143ms
143ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82e27b666f62f545833450b7bae03ecb0eb968ccf5cdbc523f636cce3c30d76d

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1kzkr67gg6bfa6h196c9wjv4msv9wyff3zndhq5zrnjwfkc2829de0cm5mtzfhdxmn2vd26011mgeeqqbrdek09wtn5k6caf69bqtsaane9ekxb6t8nv7vrwtna4cxvda56mxfyrs8x4wst6pngr25b58qyasa5wttwjc5krxh9d16kjgpapk5cen9qrmzbqt9jyq4t4erkkkdm2n65ggrp32rtqbeapna8ngc3scyhg3dj6z5hzmkagmbsfjzzrwr1d896d13k8r3gh3fvgwcgj3mmq4yh3ck1qzhwwt7wjggrm61741s9647dxsv5t08ndt1b535t4xn215ekgr3r3ta3a2n9ttan25d31wxaet0a2qam3skkgd4aswnpnbxm7kj4qgh4f1zxfmrsah9rcrtcxv18z1e2t4q5ht6svx94kcddg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%26client%3Dca-pub-8648432769746717%26adurl%3D

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=86400; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options: noopen
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection: 1; mode=block
cross-origin-embedder-policy: unsafe-none
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy: same-origin
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires: 0
surrogate-control: no-store
pragma: no-cache
cross-origin-opener-policy: unsafe-none
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6d0b1f4d6e6b839c-MXP
content-encoding: br

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame F6FF 32 KB
10 KB 66ms
65ms Script
text/html 184.30.209.152
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.209.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-209-152.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 63d38491bf3ee3a2fe10743f91416a235d63535e687129560fc208a056e2a1d0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 20 Jan 2022 20:41:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=46509
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9703
Expires: Fri, 21 Jan 2022 09:36:21 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 35E6 42 B
64 B 85ms
84ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstiegBqRd44--fRAXbbYr4skSgAYhKdutfpPFnvweeRCCPu0C4y7SDFlM47mi4oCF2Z8FoaGdqAMpQ9DbTmYevu8A&sig=Cg0ArKJSzGVRK3WbctU0EAE&cid=CAASF-RoMUSTJUSy6Z5-K9mseaeS9KiNQrvn&id=lidar2&mcvt=1010&p=1110,436,1200,1164&mtos=1010,1010,1010,1010,1010&tos=1010,0,0,0,0&v=20220119&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3647397696&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642711270764&rpt=859&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame A05D 81 KB
11 KB 104ms
104ms Stylesheet
text/css 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 20:41:12 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age: 706567
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=83581
surrogate-control: no-store
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains; preload
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: same-origin
expires: 0
last-modified: Wed, 12 Jan 2022 16:25:05 GMT
server: cloudflare
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options: noopen
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=3600, must-revalidate, proxy-revalidate
cf-ray: 6d0b1f4e4951839c-MXP
cf-bgj: minify

GET
H2 200 D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame A05D 53 KB
54 KB 95ms
85ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=V11ayA==, md5=Cid9We/KA2mmmDZF4nNlng==
date: Thu, 20 Jan 2022 20:41:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 405
cf-polished: origFmt=png, origSize=115129
x-guploader-uploadid: ADPycduhHM7H-Q_jkF-MDMaUy9EF8w8o7lNZ8Td_D1IvjCj_YUCar4gG0lG_gL_cUfAGNFtbOr4UBHx89A0C6PJGhS0
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 54564
last-modified: Tue, 09 Feb 2021 15:11:24 GMT
server: cloudflare
etag: "0a277d59efca0369a6983645e273659e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EcLkccWzYKuTpzX2LZz05c6uoG3tEqZonUJTc2g7u5X%2FQSFOL2ZaboDUDKrzet9RiVwQfoeoaVJGPkFb9oLzcEBY0%2Fsb2gkeXWvKJlAYEokBCczhS4wvZlLWHkM%2BK%2B8uxHNx6ysecdjxrb36"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1612883484779402
content-type: image/webp
expires: Fri, 21 Jan 2022 20:41:12 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 115129
accept-ranges: bytes
cf-ray: 6d0b1f4e5fe85a25-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 1D53E9CF3821E81F5644C8C6FD10FC3C1E53F2F21748B14D50333BD8E08058E50BE70BEE9D071C4FD38992D3B57467DAA70308BF0B8E9E5A740263D0F5C9EE6D
assets.ad4m.at/product_image/ Frame A05D 21 KB
22 KB 142ms
134ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/1D53E9CF3821E81F5644C8C6FD10FC3C1E53F2F21748B14D50333BD8E08058E50BE70BEE9D071C4FD38992D3B57467DAA70308BF0B8E9E5A740263D0F5C9EE6D
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea39dba2b498dfe4e18255e241acf246f9229c8deb54e5b2530cadb51a25bd58

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=dV1e1g==, md5=OdUvFkjawxXrzJxPpO1XKA==
date: Thu, 20 Jan 2022 20:41:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 263542
cf-polished: qual=85, origFmt=jpeg, origSize=60655
x-guploader-uploadid: ADPycdvVuWt88cAZ8f4IHW_vPBHbn7FuEX160cYlTHK8R0i-zla8VTKio-imWy3RDz1pZ-DTNaX19BPsn6JOdSUMUwI
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21982
last-modified: Fri, 11 Dec 2020 13:58:13 GMT
server: cloudflare
etag: "39d52f1648dac315ebcc9c4fa4ed5728"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GyoWgHkPfV8hbNz4S1gG1EF2Eek6JSO1veecztjjA0Oy5jL%2FCPspaVJEy5mHYNGPjdM4omT473dP6Wpangtkm8TFm5SF2FMrFQZG1nVue7kfY0BUxeMaxqDvhI9x2keGSG90nx%2F1xD89CKRl"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1607695093714344
content-type: image/webp
expires: Fri, 21 Jan 2022 20:41:12 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 60655
accept-ranges: bytes
cf-ray: 6d0b1f4e5fea5a25-MXP
cf-bgj: imgq:85,h2pri

GET
H/1.1

200
OK

/
partner.o2online.de/a/ Frame A05D
Redirect Chain

https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022012021411262479143775X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidMWJUvhx...

49 B
1 KB

63ms
23ms

Image
image/gif

46.4.41.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022012021411262479143775X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022012021411262479143775X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Server: 46.4.41.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nonstopads2.sunbonet.de
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 20 Jan 2022 20:41:12 GMT
X-NODEIP: 46.4.41.145
Server: nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-content-type-options: nosniff
server: nginx
content-type: text/html; charset=UTF-8
location: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022012021411262479143775X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022012021411262479143775X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
assets.ad4m.at/logo/ Frame A05D 9 KB
10 KB 141ms
133ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5eeedf9055f9efab9127642b4c44135be9f404caa7ce08e51a5ea734dfd28828

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=euqM8A==, md5=F0uw3DVkfiBLCaoSCWVgSg==
date: Thu, 20 Jan 2022 20:41:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9781
cf-polished: origFmt=png, origSize=24833
x-guploader-uploadid: ADPycdtd_qzJJ2j8fLhc4MnJy8Pr9WXO00HsOwNKEMijhkjdKL7lwbsOmTLi6JDxSHzxUMKw-IAs7yuzXaCBOIMf-G4xdCME-A
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9258
last-modified: Tue, 09 Feb 2021 15:11:57 GMT
server: cloudflare
etag: "174bb0dc35647e204b09aa120965604a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dxZd4pWso6yz3%2FxJSgkkqynDncS7hSufN55dct5uupSy3uDF4QX4XTr5wBb3WgKU7ctqjAQbKGf3JVKILoUQ%2BIddVdq1p%2Bm0Dt8BADAu0l0XHpPnygbBtpdyQM8eKSgXKFLfpTlZ2VJH65Yl"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1612883517528266
content-type: image/webp
expires: Fri, 21 Jan 2022 20:41:12 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 24833
accept-ranges: bytes
cf-ray: 6d0b1f4e5fed5a25-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 0AC0DD533161B07A3BB2D72DC66FF10DF997383C63884E78FDBEF4BEDA8ED904DC259BD68D098814FB574FED8B566E90A3C1272EA9C368275203F9D628BB015E
assets.ad4m.at/product_image/ Frame A05D 19 KB
19 KB 85ms
77ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/0AC0DD533161B07A3BB2D72DC66FF10DF997383C63884E78FDBEF4BEDA8ED904DC259BD68D098814FB574FED8B566E90A3C1272EA9C368275203F9D628BB015E
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 769996a987ead923de78ded8af9ebbc0125bfdca436dfadfdc9755fd54270371

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=1aKs/g==, md5=nBaxji7Rcg1LrHhoV5P3TA==
date: Thu, 20 Jan 2022 20:41:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 259717
cf-polished: qual=85, origFmt=jpeg, origSize=84530
x-guploader-uploadid: ADPycdvU-vy6uLJIhnM2MCYzQQwh73ry6oPFAcI0NmJVRHB4s6fMHKxrD63u8VTf5bG0ISX-McNshCLsxEEMdfLNO2E
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19022
last-modified: Wed, 10 Nov 2021 15:00:52 GMT
server: cloudflare
etag: "9c16b18e2ed1720d4bac78685793f74c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=REiM2%2Bl1SMFBDMxd%2FB%2Bm0m%2FSem9nxBVqSOzi4NImaJO683JzDoaPMMz3qpMpGjKLsXOEF7oEwC08LVy%2BPTvzvDNOpAZw0bNZaetuhuvcXNpqo1EFqLPLPtnSyh0zcOg4vm1Y%2BsjxG%2F5IHMMq"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1636556452656256
content-type: image/webp
expires: Fri, 21 Jan 2022 20:41:12 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 84530
accept-ranges: bytes
cf-ray: 6d0b1f4e5fe15a25-MXP
cf-bgj: imgq:85,h2pri

GET
H/1.1

200
OK

/
partner.blau.de/a/ Frame A05D
Redirect Chain

https://www.telefonica-partner.de/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
https://www.lead-alliance.net/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022012021411262479143773X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidMWJUvhx4Z...

49 B
1 KB

56ms
21ms

Image
image/gif

46.4.62.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022012021411262479143773X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Server: 46.4.62.19 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nonstopads4.sunbonet.de
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 20 Jan 2022 20:41:12 GMT
X-NODEIP: 46.4.62.19
Server: nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-content-type-options: nosniff
server: nginx
content-type: text/html; charset=UTF-8
location: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022012021411262479143773X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 C35143419725FFAB72E7F85B0896E2CE1CF38E8530EF6A0FABB9A59404159EF275766FB79658D3B5D6644C20EACFACC3D3AEC4962CC34DBF676104F9A9E97E4B
assets.ad4m.at/logo/ Frame A05D 12 KB
12 KB 91ms
83ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/C35143419725FFAB72E7F85B0896E2CE1CF38E8530EF6A0FABB9A59404159EF275766FB79658D3B5D6644C20EACFACC3D3AEC4962CC34DBF676104F9A9E97E4B
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47ec02e18941bc1fe215e0bf1b47eaef6dd674b8adfb18d17e980203a94b9ff4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=L9xAnQ==, md5=7eHZFVWQuqeYNRiE/JSb0A==
date: Thu, 20 Jan 2022 20:41:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1216
cf-polished: qual=85, origFmt=jpeg, origSize=42488
x-guploader-uploadid: ADPycdvhHW_zHh7wSks7RM_SvLJNc2ZYJNMyKvIavRP8EZA07rDwlNBXYZnj7GOwhSla86zcCYJl620YpVDQrilWDEw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12110
last-modified: Thu, 25 Jun 2020 11:29:58 GMT
server: cloudflare
etag: "ede1d9155590baa798351884fc949bd0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mJyStmy7KpSfVpU7UMMArlerN7NQeEmdjcuSQ%2Fih9qVu7mGME27XLBiDHII66k4Rhx2mR9pA0kcSXyvTUEa1sVwPVBH40SQtkXHB4Z%2FNAhsSHDU1mCumUrfuQPlySpxV25FY%2BnAC00TGnUgN"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1593084598972955
content-type: image/webp
expires: Fri, 21 Jan 2022 20:41:12 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 42488
accept-ranges: bytes
cf-ray: 6d0b1f4e5fe65a25-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 6B38C70234B9F3188DD5EE431E82865D3F73254228570FEAA8E0EC084126CA428EE25DBF94F692B9BBC7FE9C22F4F555A804B8157CE8832EEFA3C4F5253BE361
assets.ad4m.at/product_image/ Frame A05D 72 KB
73 KB 141ms
134ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/6B38C70234B9F3188DD5EE431E82865D3F73254228570FEAA8E0EC084126CA428EE25DBF94F692B9BBC7FE9C22F4F555A804B8157CE8832EEFA3C4F5253BE361
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40ce033c8ee824b2a4e435541df84a0d95075fafa382deb7a91c02f9e15bbe1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=FQtvKA==, md5=fhrs2Vg2w7QpQT0tLI6VHw==
date: Thu, 20 Jan 2022 20:41:12 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 265309
cf-polished: origFmt=png, origSize=128410
x-guploader-uploadid: ADPycdvoY1hExvyQKTOhD2EtL0HAkl01GwakEvR7TNX0Oj9oUjMMetjzIwqDcsDEAtClS5FW5GlL4yXG_BMSvrS9IrI
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 73694
last-modified: Fri, 10 Dec 2021 12:01:51 GMT
server: cloudflare
etag: "7e1aecd95836c3b429413d2d2c8e951f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S7Ynx%2FnmrGm4CVskX450GBn7JhvTQFC6RTA27zRJ0gE6NMiVZ2%2Bnnog%2FpuBP%2F%2BusBlMv4mFXrH08OeqbbzYK4kSopx7vNckxwMeC96eeKJSUWwefKAUk8KLyc%2FZfiQEnAiuU%2FU1lE3EBScMJ"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1639137711863674
content-type: image/webp
expires: Fri, 21 Jan 2022 20:41:12 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 128410
accept-ranges: bytes
cf-ray: 6d0b1f4e5fe55a25-MXP
cf-bgj: imgq:85,h2pri

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame F6FF 284 B
536 B 137ms
24ms Image
image/jpg 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 611afce88997db6fdd35eb213e662871
Content-Type: image/jpg

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame A05D 1 KB
2 KB 309ms
149ms Script
text/html 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3247721&wgcampaignid=1384975&js=1&nw=1&clickref=oneid64rFefw3feAxfeHmHYtECxVms2T1Tjga7oneid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&viewref=oneidMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3oneid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: e4ecd046d3cb714a54edaca8ff073aa591113bcf7a87e4aa5298d71f4bf77223

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:12 GMT
Last-Modified: Thu, 20 Jan 2022 20:41:12 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1481
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame F6FF 0
239 B 24ms
23ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Content-Type: image/gif

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 55C0 42 B
64 B 55ms
55ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstkL5LQUsgh8IM2XrmPwjtcOibWAO8LvDFAAc0U0Yf4DfEEkrZACItmw3gdhvbLEnV90lU92eC7AvJnHdA3AkZhvwl0BsprwPQu6LeMjxGac8g-h_Nb2g&sai=AMfl-YSyr5Z4sp-pcoTSZvRDVuGkcpxARRUOhJypwfzmEikOE5E25rqNLWqMK2KmEW4H40chKb_kCmgDBf2479PtJI2rJpKiIN451-fbHxYrhnkDOEGYYXOyAvwi6_Iw&sig=Cg0ArKJSzGTnPS5KyYihEAE&cid=CAASEuRoV-4-2ZmTFjBwsz8Kea8yDA&id=lidar2&mcvt=1000&p=1150,0,1204,320&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220119&bin=7&avms=nio&bs=0,0&mc=0.93&if=1&app=0&itpl=20&adk=3627485025&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642711270637&rpt=1165&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C7C4 42 B
64 B 44ms
44ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvBJWWOUnzgXPYdyAZhUKhTxrIIHfBFIx2z7dUi5OSn8uIOtGfl3dZ_t1jjMzgiaM9nBqMwynvSdnXEl5NSf5huFlDYzva2zCgGFXkh&sai=AMfl-YQk96CR82H24IrZ_dIeKZKzPO01JIWxQ4Rm4fF0pzqIDt37TOLkDyKU7tSnuS0qQzG-Cek3ZRC3MQ08_UD0_xKPaJkaC0Pa67Skv_obeerpXnh02U-BxQhygOX0&sig=Cg0ArKJSzNTKG-xZDyQOEAE&cid=CAASEuRo8CwBlg4e79A4CF6JNlNehA&id=lidar2&mcvt=1000&p=67,62,671,222&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220119&bin=7&avms=nio&bs=0,0&mc=0.99&if=1&app=0&itpl=20&adk=2802135895&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1642711270807&rpt=1101&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b656206143625da736dce71f91d95a5b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Jan 2022 20:41:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame A05D 51 KB
51 KB 167ms
51ms Script
application/javascript 143.204.215.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3247721&wgcampaignid=1384975&js=1&nw=1&clickref=oneid64rFefw3feAxfeHmHYtECxVms2T1Tjga7oneid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&viewref=oneidMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3oneid__asuidMWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIjasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-33.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: wvDglZsFnxZ0eZ1mUErJkFMo1VNidWYJ
via: 1.1 befe3b8553d90339ecf78e5d7cefa60a.cloudfront.net (CloudFront)
last-modified: Tue, 09 Nov 2021 11:05:10 GMT
server: AmazonS3
age: 57942
etag: "ec0ced40cbb5211db06b8a36f209e442"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Thu, 20 Jan 2022 04:35:32 GMT
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 51794
x-amz-cf-id: ilysZuW3yaT8GMDOUh3-tqGAKMwDuzboc1lyPt9PsQyvXNoUQ--N8g==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame A05D 25 KB
26 KB 190ms
58ms Image
image/png 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=1384975&viewref=oneidk2BF5f8jMSJezcbCwHetBtkYwSkTjTpGKaRoneid__asuid7_ZE_7kzx0GM-0jS8IeWm6TooQCoV2Fzasuid__suite_Mweb_Netmix_Reach103_TopRotaMonth&wglinkid=3247721
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C19491%2C43784&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CMm9Uzfpram3JfWHEHGtDtdzps9T4TPDa3&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2C64rFefw3feAxfeHmHYtECxVms2T1Tjga7&c=728&d=90&e=MWJUvhx4ZsITArBVnb2Ghw-5vPxVHPIj&g=f37e5ed09ccc1f0b8a5008c4aee6afa7%2F3693654862816236960&i=20774%2C20773%2C27720&j=14%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1642711272438&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1hq688ghpa2qvs8c1rhqz18jdh0jfrz6abbc22vnv60j2ycw96674vhes1p1mq97aggq0xd7611zkzq5b0dwrqs9esxghmds4tqfr9x0mq7hv0rcf7npyw5fvsh4cv8r5ct65jd7hf87kmkh1ybrp9wk2tjk2t5vpppjg6z2wkjfrpkqptw8h456ete41n02wbdcmvf3ww79st0145yjsd9edw9j0jch1gt4w17xnjmp1fpthv2ar23hprgmzztjvwt0t74fw3z8xds4z6wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCLfqr5sjpYYWAE5rjgAeVqayoBJDhgYRctqjCivACwI23ARABIABglZqSgqAHggEXY2EtcHViLTg2NDg0MzI3Njk3NDY3MTegAcKu6N0DyAEJqQLx-EQiKgGzPuACAKgDAaoE_QFP0EqmZeJB78ShhPLwtMMBWHIpTNoG0ofO4JzXJg8T1ajnx88B5jQTgHQjbv_QJbbuITjRiUMVwWooYjdQyXRRRUQdM1ZigbgJQ3SZckKgmU1mQqbtYk-uST5F6OYjfXv8Lcj_bNKDWFsPcI5lCC7DnxFNAEKQw4JKVy7CiIX4LAq-KVZ-LmqYxFp7PTePd3E2bTC-tN9mK3l0VI3gl4VDoLEFuTh61k7r499k_NmBpq7BbI-2HS01rz8Q8udaqQrDj4bbysMyTwK4qfyo0Wmjhj6Eg4KT3sEElc9ET_XCywg30agqElwZtbdtYFgrGIDakLJKTKYOD4QdX26S4AQBgAaj4ejr-ezk1_cBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAHyCBthZHgtc3Vic3luLTE0NTU0OTA0Nzk5MDM4NzP6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_1CylqIsCp8pbKL_p56NhMjxohJ8A%252526client%25253Dca-pub-8648432769746717%252526adurl%25253D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 4bcba6ca13d0bf1606176d2408363d0370505b999089d312da533a86406ba2e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 20 Jan 2022 20:41:13 GMT
Last-Modified: Thu, 20 Jan 2022 20:41:13 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6998 0
729 B 67ms
67ms Script
text/html 185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS